Container safety protection method, device, equipment, medium and program product

Abstract

The invention provides a container safety protection method which can be applied to the technical field of cloud computing. The container security protection method comprises the following steps: in response to a cluster container creation operation, intercepting a container deployment request; verifying the to-be-deployed container through the dynamic access control service; and if it is determined that the to-be-deployed container does not pass verification, refusing the container creation operation and returning error response information. The invention further provides a container safety protection device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of cloud computing, specifically to the field of container deployment technology, and more specifically to a container security protection method, device, equipment, medium and program product. Background Art

[0002] As cloud-native practices in the industry develop rapidly, more and more services are deployed in Kubernetes clusters. However, if the enterprise's HIDS is based on the host-based intrusion detection system (HIDS) and does not optimize certain policies for container characteristics, it is easy to deploy privileged containers in the Kubernetes cluster, through which the root management permissions of the server can be obtained, thus forming a management risk for the server.

[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a container security protection method, device, equipment, medium and program product for improving container security protection.

[0005] According to a first aspect of the present disclosure, there is provided a container security protection method, comprising: in response to a cluster container creation operation, intercepting a container deployment request;

[0006] Verify the deployed container through the dynamic admission control service; and

[0007] If it is determined that the container to be deployed has not passed the verification, the container creation operation is rejected and an error response message is returned.

[0008] According to an embodiment of the present disclosure, verifying the container to be deployed by the dynamic admission control service includes:

[0009] Parse the container deployment request to obtain the container group specification information passed in by the container to be deployed;

[0010] Checking security context information in the container group specification based on a preset security policy; and

[0011] If it is determined that the container to be deployed complies with the preset security policy, it is determined that the container to be deployed passes the verification.

[0012] According to an embodiment of the present disclosure, the preset security policy includes limiting the number of permissions requested by the container, prohibiting the container from running as a super user, and prohibiting the container from mounting a specified host system path.

[0013] According to an embodiment of the present disclosure, checking the security context information in the container group specification based on the preset security policy includes:

[0014] Determine whether the number of container permission requests is greater than a preset threshold;

[0015] determining whether the container is a privileged container; and

[0016] Determines whether the container mounts the specified host system path.

[0017] According to an embodiment of the present disclosure, before intercepting the container deployment request, the method further includes:

[0018] Enable an admission controller, which is used to intercept deployment requests for all containers; and

[0019] Configure triggers and admission control policies for dynamic admission control services.

[0020] According to an embodiment of the present disclosure, rejecting the container creation operation and returning error response information includes:

[0021] When it is determined that the dynamic admission control service rejects the container creation operation, an error response message is sent to the cluster control plane, where the error response message includes a status code and a reason for rejecting the container creation operation.

[0022] According to an embodiment of the present disclosure, the method further includes:

[0023] When a node joins a cluster, a label is set for the node through the cluster's label system;

[0024] generating a secure shell protocol key pair for each node; and

[0025] Distribute and configure the Secure Shell protocol public key based on the node label.

[0026] A second aspect of the present disclosure provides a container security protection device, including: an interception module, configured to intercept a container deployment request in response to a cluster container creation operation;

[0027] A verification module, used to verify the container to be deployed through the dynamic admission control service; and

[0028] The error information response module is used to reject the container creation operation and return an error response message if it is determined that the container to be deployed has not passed the verification.

[0029] According to an embodiment of the present disclosure, the verification module includes: a parsing submodule, a verification submodule and a determination submodule.

[0030] A parsing submodule is used to parse the container deployment request to obtain the container group specification information passed in by the container to be deployed;

[0031] A verification submodule, configured to check security context information in the container group specification based on a preset security policy; and

[0032] The determination submodule is used to determine that the container to be deployed passes the verification if it is determined that the container to be deployed complies with the preset security policy.

[0033] According to an embodiment of the present disclosure, the verification submodule includes a first determination unit, a second determination unit and a third determination unit.

[0034] A first determining unit, configured to determine whether the number of permissions requested by the container is greater than a preset threshold;

[0035] A second determining unit, configured to determine whether the container is a privileged container; and

[0036] The third determining unit is used to determine whether the container mounts the specified host system path.

[0037] According to an embodiment of the present disclosure, the device further includes: an admission controller enabling module and a configuration module.

[0038] An admission controller startup module, used to enable an admission controller, wherein the admission controller is used to intercept deployment requests of all containers; and

[0039] The configuration module is used to trigger the dynamic admission control service and configure the admission control policy.

[0040] According to an embodiment of the present disclosure, the error information response module is also used to send error response information to the cluster control plane after determining that the dynamic admission control service rejects the container creation operation, and the error response information includes a status code and a reason for rejecting the container creation operation.

[0041] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0042] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the above computer program or instructions are executed by a processor.

[0043] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor.

[0044] Through the container security protection method provided by the embodiment of the present disclosure, the cluster's access control mechanism is used to monitor and control the deployment of containers, and the dynamic access control service is used to automatically intercept and verify privileged container deployment requests to prevent unauthorized root permissions from being obtained. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0046] Figure 1 The application scenario diagram of the container security protection method, device, equipment, medium and program product according to the embodiment of the present disclosure is schematically shown;

[0047] Figure 2 A flowchart of a container security protection method according to an embodiment of the present disclosure is schematically shown;

[0048] Figure 3 A flowchart of a container safety protection method according to another embodiment of the present disclosure is schematically shown;

[0049] Figure 4 A flowchart of a container safety protection method according to another embodiment of the present disclosure is schematically shown;

[0050] Figure 5 A flowchart of a container safety protection method according to another embodiment of the present disclosure is schematically shown;

[0051] Figure 6 A structural block diagram of a container safety protection device according to an embodiment of the present disclosure is schematically shown; and

[0052] Figure 7 A block diagram of an electronic device suitable for implementing a container safety protection method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0053] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0054] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0055] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0056] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0057] First, the terms that appear in the embodiments of the present disclosure are explained:

[0058] Kubernetes: An open source container orchestration platform for automating the deployment, scaling, and management of containerized applications.

[0059] Admission webhook: A dynamic interceptor in Kubernetes that processes and validates resource objects (such as Pods) before they are persisted.

[0060] Privileged container: A container with additional permissions within the container, which may pose a security risk to the host machine.

[0061] HIDS (Host-based Intrusion Detection System): A host-based intrusion detection system used to detect and respond to threats against servers.

[0062] POD: In Kubernetes, Pod is the most basic deployment unit. It is a logical host that can contain one or more containers (such as Docker containers). Containers in a Pod share network and storage resources and run in the same context, which means they share the same network namespace, IP address, and storage volume.

[0063] Key features of Pods include:

[0064] Shared Network: All containers within a Pod can communicate using localhost, and ports can be shared between them.

[0065] Storage sharing: Containers in a Pod can access the same storage volumes, which allows them to share data.

[0066] Independent operation: Each Pod is an independent process with its own process ID number space.

[0067] Simple management: The Kubernetes API (Application Programming Interface) uses Pod as the unit of operation and management, and can start, stop, and delete Pods.

[0068] Resource guarantees: Pods can request specific computing resources (CPU and memory), and Kubernetes will try its best to guarantee the resource requirements of Pods.

[0069] Restart policy: A Pod has a defined restart policy. If a container in a Pod fails, Kubernetes can automatically restart the container according to the configured policy.

[0070] Lifecycle management: Pod supports defining lifecycle hooks for containers, allowing specific operations to be performed before the container is started or shut down.

[0071] Health Check: Pods can be configured with Liveness and Readiness Probes to determine whether the container is healthy and ready to accept traffic.

[0072] With the rapid development and application of cloud native, it is easy for related technologies to deploy privileged containers in the cluster, through which the root management permissions of the server can be obtained, thus posing management risks to the server.

[0073] Based on the above technical problems, an embodiment of the present disclosure provides a container security protection method, which includes: intercepting a container deployment request in response to a cluster container creation operation; verifying the container to be deployed through a dynamic access control service; and if it is determined that the container to be deployed fails the verification, rejecting the container creation operation and returning an error response message.

[0074] Figure 1 The application scenario diagram of the container security protection method, device, equipment, medium and program product according to the embodiments of the present disclosure is schematically shown.

[0075] like Figure 1As shown, the application scenario 100 according to this embodiment may include a large-scale server installation scenario. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0076] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0077] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0078] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0079] It should be noted that the container security protection method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the container security protection device provided in the embodiment of the present disclosure can generally be set in the server 105. The container security protection method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the container security protection device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0080] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements. Figure 1The application scenarios shown are only examples of application scenarios and system architectures to which the embodiments of the present disclosure can be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios. It should be noted that the container security protection method and device determined in the present disclosure can be used in the financial field, and can also be used in any field other than the financial field. The application field of the container security protection method and device determined in the present disclosure is not limited.

[0081] The following will be based on Figure 1 The scene described by Figure 2~Figure 5 The container security protection method of the disclosed embodiment is described in detail.

[0082] Figure 2 The flowchart of a container security protection method according to an embodiment of the present disclosure is schematically shown.

[0083] In operation S210, an admission controller is enabled, where the admission controller is used to intercept deployment requests of all containers.

[0084] In operation S220, trigger configuration and admission control policy configuration are performed on the dynamic admission control service.

[0085] In one example, in order to intercept container deployment requests, first check whether the Admission webhook controller, i.e., the admission controller, is enabled in the cluster. Admission webhook is a resource object that allows cluster administrators to execute custom admission control logic. In the disclosed embodiment, ensure that the Admission webhook controller is enabled in the cluster, and the Admission webhook controller is used to intercept deployment requests for all containers.

[0086] In one example, a callback service that handles admission requests is written, which can be called a dynamic admission control service, and the service is deployed in a Kubernetes cluster; in this step, a dynamic admission control service is written, which will run as a Pod in the Kubernetes cluster. This service will implement the following functions: 1) Listen for deployment requests: The service will listen to all container deployment requests entering the cluster. 2) Verify container specifications: For each deployment request, the service will parse and verify the container specifications, especially checking whether there is a privileged mode setting. 3) Implement admission policies: The service will decide whether to allow deployment based on preset admission policies. These policies may include checking whether the container has requested too many permissions, whether it attempts to run as the root user, or whether it attempts to mount sensitive host system paths.

[0087] In one example, deploy a dynamic admission control service; deploy the written dynamic admission control service as a Pod in the Kubernetes cluster, and expose its network endpoints through Service and Ingress so that the Admissionwebhook controller can communicate with it. Configure the Admission webhook to point to the network endpoint of the dynamic admission control service, and set rules to trigger the webhook. For example, you can configure it to trigger on any attempt to deploy a Pod.

[0088] For example, in Kubernetes, implementing a dynamic admission control service requires writing a network service that can handle API server calls and running it as a Pod in the cluster. Here are the steps to implement the above functions: 1) Define the admission control logic: Write a service endpoint that will implement the required admission control logic. This may include checking the security context in the Pod specification, such as privileged mode, user ID, SELinux label, etc. 2) Create a service Pod: Write a configuration file for a Pod that will run your dynamic admission control service. This Pod needs to have network access permissions so that it can communicate with the Kubernetes API server. 3) Service deployment: Deploy the Pod of the dynamic admission control service to the Kubernetes cluster. This is usually done by applying a YAML configuration file that defines the resource requirements, environment variables, and other necessary settings for the Pod.

[0089] For example, configure Service and Ingress, create a Kubernetes Service to expose the network port of the dynamic admission control service, and configure Ingress if you need to access it from outside the cluster. Implement the Kubernetes AdmissionReview interface, which will receive AdmissionReview requests and return AdmissionResponse. This is the core of the admission control logic. Create a ValidatingWebhookConfiguration or MutatingWebhookConfiguration object, configure the URL Uniform Resource Locator (URL) of the Webhook (pointing to the dynamic admission control service) and other related settings, such as namespace selector, object selector, etc.

[0090] Figure 3 A flow chart of a container security protection method according to another embodiment of the present disclosure is schematically shown.

[0091] like Figure 3 As shown, the container security protection method of this embodiment includes operations S310 to S330, and the transaction processing method can be executed by a server or other computing devices.

[0092] In operation S310 , in response to a cluster container creation operation, a container deployment request is intercepted.

[0093] In operation S320 , the container to be deployed is verified by the dynamic admission control service.

[0094] In operation S330, if it is determined that the container to be deployed has not passed the verification, the container creation operation is rejected and an error response message is returned.

[0095] In one example, when a container is to be deployed in a Kubernetes cluster, the dynamic admission control service intercepts the deployment request and verifies it according to the admission policy written by the service. If a privileged container is deployed, the dynamic admission control service rejects the deployment request and returns an error response, thereby ensuring that no event occurs in the Kubernetes cluster where the server root management privileges are obtained due to the creation of a privileged container.

[0096] Through the container security protection method provided by the embodiment of the present disclosure, the cluster's access control mechanism is used to monitor and control the deployment of containers, and the dynamic access control service is used to automatically intercept and verify privileged container deployment requests to prevent unauthorized root permissions from being obtained.

[0097] Figure 4 A flowchart of a container security protection method according to another embodiment of the present disclosure is schematically shown. Figure 5 A flowchart of a container security protection method according to another embodiment of the present disclosure is schematically shown.

[0098] In operation S410 , in response to a cluster container creation operation, a container deployment request is intercepted.

[0099] In operation S420 , the container deployment request is parsed to obtain container group specification information passed in by the container to be deployed.

[0100] In operation S430 , security context information in the container group specification is checked based on a preset security policy.

[0101] According to an embodiment of the present disclosure, the preset security policy includes limiting the number of permissions requested by the container, prohibiting the container from running as a super user, and prohibiting the container from mounting a specified host system path.

[0102] like Figure 5 As shown, operation S430 includes operations S431 to S433.

[0103] In operation S431, it is determined whether the number of container permission requests is greater than a preset threshold.

[0104] In operation S432, it is determined whether the container is a privileged container.

[0105] In operation S433 , it is determined whether the container mounts the specified host system path.

[0106] In operation S440, if it is determined that the container to be deployed complies with the preset security policy, it is determined that the container to be deployed passes the verification.

[0107] In operation S450, if it is determined that the container to be deployed has not passed the verification, the container creation operation is rejected and an error response message is returned.

[0108] According to an embodiment of the present disclosure, after determining that the dynamic admission control service rejects the container creation operation, an error response message is sent to the cluster control plane, where the error response message includes a status code and a reason for rejecting the container creation operation.

[0109] In one example, after intercepting a container deployment request, the Pod specification passed in by the container to be deployed is analyzed, especially fields such as privileged mode, user identifier, and additional permissions. It is compared with the preset security policies, which include limiting the number of permissions requested by the container, prohibiting the container from running as a super user, and prohibiting the container from mounting a specified host system path; determining whether the container requests too many permissions, determining whether the container attempts to run with root permissions, and determining whether the container attempts to mount in a sensitive host system path. If the Pod specification violates these policies, for example, attempting to run in privileged mode, it is determined that the container to be deployed has not passed the verification and the creation operation is rejected. When the dynamic admission control service rejects a deployment request, it sends an error response to the Kubernetes API server, which contains detailed information such as the status code and the reason for the rejection of the container creation operation, so that developers can adjust their deployment requests based on this information.

[0110] Based on the above container safety protection method, the present disclosure also provides a container safety protection device. Figure 6 The device is described in detail.

[0111] Figure 6 The structural block diagram of the container safety protection device according to an embodiment of the present disclosure is schematically shown.

[0112] like Figure 6 As shown, the container safety protection device 600 of this embodiment includes an interception module 610 , a verification module 620 and an error information response module 630 .

[0113] The interception module 610 is used to intercept the container deployment request in response to the cluster container creation operation. In one embodiment, the interception module 610 can be used to perform the operation S310 described above, which will not be repeated here.

[0114] The verification module 620 is used to verify the container to be deployed through the dynamic admission control service. In one embodiment, the verification module 620 can be used to perform the operation S320 described above, which will not be repeated here.

[0115] The error information response module 630 is used to reject the container creation operation and return an error response message if it is determined that the container to be deployed has not passed the verification. In one embodiment, the error information response module 630 can be used to perform the operation S330 described above, which will not be repeated here.

[0116] According to an embodiment of the present disclosure, the verification module includes: a parsing submodule, a verification submodule and a determination submodule.

[0117] The parsing submodule is used to parse the container deployment request to obtain the container group specification information passed in by the container to be deployed; in one embodiment, the parsing submodule can be used to perform the operation S420 described above, which will not be repeated here.

[0118] The verification submodule is used to check the security context information in the container group specification based on a preset security policy; in one embodiment, the verification submodule can be used to perform the operation S430 described above, which will not be described in detail here.

[0119] The determination submodule is used to determine that the container to be deployed passes the verification if it is determined that the container to be deployed complies with the preset security policy. In one embodiment, the determination submodule can be used to perform the operation S440 described above, which will not be repeated here.

[0120] According to an embodiment of the present disclosure, the verification submodule includes a first determination unit, a second determination unit and a third determination unit.

[0121] The first determination unit is used to determine whether the number of container permission requests is greater than a preset threshold. In one embodiment, the first determination unit can be used to perform the operation S431 described above, which will not be repeated here.

[0122] The second determination unit is used to determine whether the container is a privileged container. In one embodiment, the second determination unit can be used to perform the operation S432 described above, which will not be repeated here.

[0123] The third determination unit is used to determine whether the container mounts the specified host system path. In one embodiment, the third determination unit can be used to perform the operation S433 described above, which will not be repeated here.

[0124] According to an embodiment of the present disclosure, the device further includes: an admission controller enabling module and a configuration module.

[0125] The admission controller startup module is used to enable the admission controller, and the admission controller is used to intercept deployment requests of all containers. In one embodiment, the admission controller startup module can be used to perform the operation S210 described above, which will not be repeated here.

[0126] The configuration module is used to perform trigger configuration and admission control policy configuration on the dynamic admission control service. In one embodiment, the configuration module can be used to perform the operation S220 described above, which will not be described in detail here.

[0127] According to an embodiment of the present disclosure, the error information response module is also used to send an error response message to the cluster control plane when it is determined that the dynamic admission control service rejects the container creation operation, and the error response message includes a status code and a reason for rejecting the container creation operation. In one embodiment, the error information response module can be used to perform the operation S450 described above, which will not be repeated here.

[0128] According to an embodiment of the present disclosure, any multiple modules of the interception module 610, the verification module 620, and the error information response module 630 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the interception module 610, the verification module 620, and the error information response module 630 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, at least one of the interception module 610, the verification module 620, and the error information response module 630 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be executed.

[0129] Figure 7 A block diagram of an electronic device suitable for implementing a container safety protection method according to an embodiment of the present disclosure is schematically shown.

[0130] like Figure 7As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 to a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0131] In RAM 903, various programs and data required for the operation of electronic device 900 are stored. Processor 901, ROM 902 and RAM 903 are connected to each other via bus 904. Processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 902 and / or RAM 903. It should be noted that the program can also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0132] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the input / output (I / O) interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 908 including a hard disk, etc.; and a communication portion 909 including a network interface card such as a LAN card, a modem, etc. The communication portion 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed, so that a computer program read therefrom is installed into the storage portion 908 as needed.

[0133] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0134] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than ROM 902 and RAM 903.

[0135] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program includes a program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the container security protection method provided by the embodiment of the present disclosure.

[0136] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 901. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0137] In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and downloaded and installed through the communication part 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0138] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0139] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0140] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0141] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0142] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A container safety protection method, characterized in that: The method comprises: In response to a cluster container creation operation, intercepting a container deployment request; Verify the deployed container through the dynamic admission control service; and If it is determined that the container to be deployed has not passed the verification, the container creation operation is rejected and an error response message is returned.

2. The method according to claim 1, characterized in that The verification of the container to be deployed by the dynamic admission control service includes: Parse the container deployment request to obtain the container group specification information passed in by the container to be deployed; Checking security context information in the container group specification based on a preset security policy; and If it is determined that the container to be deployed complies with the preset security policy, it is determined that the container to be deployed passes the verification.

3. The method according to claim 2, characterized in that The preset security policy includes limiting the number of permissions requested by the container, prohibiting the container from running as a super user, and prohibiting the container from mounting a specified host system path.

4. The method according to claim 3, characterized in that The checking of security context information in the container group specification based on the preset security policy includes: Determine whether the number of container permission requests is greater than a preset threshold; determining whether the container is a privileged container; and Determines whether the container mounts the specified host system path.

5. The method according to any one of claims 1 to 4, characterized in that Before intercepting the container deployment request, it also includes: Enable an admission controller, which is used to intercept deployment requests for all containers; and Configure triggers and admission control policies for dynamic admission control services.

6. The method according to claim 5, characterized in that The rejecting the container creation operation and returning error response information includes: When it is determined that the dynamic admission control service rejects the container creation operation, an error response message is sent to the cluster control plane, where the error response message includes a status code and a reason for rejecting the container creation operation.

7. A container safety protection device, characterized in that: The device comprises: An interception module, configured to intercept a container deployment request in response to a cluster container creation operation; A verification module, used to verify the container to be deployed through the dynamic admission control service; and The error information response module is used to reject the container creation operation and return an error response message if it is determined that the container to be deployed has not passed the verification.

8. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images