Method and device for constructing mirror image based on containerized environment and storage medium
By building a mirror without a command line interpreter in a containerized environment, the security risks caused by the basic image containing bash or shell programs by default in the prior art is solved, and higher security and smaller attack surface are achieved.
Patent Information
- Application Number
- CN202411541317.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-31
- Publication Date
- 2025-02-18
AI Technical Summary
In existing containerization technologies, most basic images contain bash or shell programs by default, resulting in security risks that attackers can use to attack.
By selecting the basic image matching the business language stack, checking and removing the command line interpreter program therein, building a basic image without a command line interpreter, and further removing the command line interpreter program during the production image building process.
It effectively reduces the possibility of attackers using command line interpreter programs to attack, improves the security of the application system, and reduces the risk of internal network being scanned.
Smart Images
Figure CN119473501A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of computer network security technology, and specifically provides a method, device and storage medium for building an image based on a containerized environment. Background Art
[0002] Containerization technology: Containerization technology is a lightweight, portable computing environment virtualization method that allows developers to package applications and their dependent environments together to achieve consistent operation across different computing environments. The main implementations of containerization technology include Docker and others.
[0003] Image: In containerization technology, an image is a read-only template used to create a container. It contains all the files and metadata required for the container to run, such as application code, runtime libraries, environment variables, and configuration files.
[0004] With the rise of cloud computing and microservice architecture, containerization technology has been widely used. By packaging applications and their dependent environments together, containerization technology enables consistent operation across different computing environments, improving development efficiency and application deployment flexibility. The main implementations of containerization technology include Docker and others.
[0005] However, containerization technology also brings some security risks. In the security field, application systems are vulnerable to attacks, such as the classic log4j. After the attacker breaks into the application through a vulnerability, he will try to obtain the operating environment permissions, install backdoor programs, execute system commands, establish a rebound shell, or use it as a springboard to scan the internal network. These operations all rely on the bash or shell program in the operating environment.
[0006] Existing technology and technical defects:
[0007] In the prior art, most container base images contain bash or shell programs by default. This provides an attack path for attackers. Even if the production image does not directly use bash or shell programs, attackers may still use these programs to attack because the base image contains these programs.
[0008] In view of this, the present invention patent is proposed. Summary of the invention
[0009] In view of the above technical problems, the present invention proposes a method, device and storage medium for building an image based on a containerized environment. Specifically, the following technical solutions are adopted:
[0010] In a first aspect, the present invention provides a method for building an image based on a containerized environment, comprising:
[0011] Start building the image;
[0012] Select a base image that matches the business language stack, check the command line interpreter program in the base image and remove it, and obtain a base image without a command line interpreter.
[0013] An initial production image is built based on a base image without a command line interpreter, and command line interpreter programs in the initial production image are checked and removed to obtain a final production image.
[0014] As an optional embodiment of the present invention, in a method for building an image based on a containerized environment of the present invention, checking the command line interpreter program in the base image and removing it includes:
[0015] Check the file contents of the base image and search for the specified bash program-specific commands or keywords;
[0016] If the search results are returned, the base image contains the bash program, which is removed. If the search results are not returned, the base image does not contain the bash program.
[0017] As an optional embodiment of the present invention, in a method for building an image based on a containerized environment of the present invention, if the returned search result shows that the basic image contains a bash program, the method further includes:
[0018] Check the file contents of the base image to see if there is a first line containing a specific bash statement and if / bin / bash is in that line, determine the starting position of the bash program if so;
[0019] The check continues from the starting position of the bash program. When the exit command identifier exit is found, the end position of the bash program is determined.
[0020] Remove the contents from the start to the end of the bash program in the file content of the base image.
[0021] As an optional embodiment of the present invention, in a method for building an image based on a containerized environment of the present invention, checking the command line interpreter program in the base image and removing it includes:
[0022] Check the file contents of the base image to see if there is a first line containing a specific bash statement and whether / bin / bash is in that line;
[0023] If yes, the base image contains the bash program, and the starting position of the bash program is determined to contain a specific bash declaration line;
[0024] The check continues from the starting position of the bash program. When the exit command identifier exit is found, the end position of the bash program is determined.
[0025] Remove the contents from the start to the end of the bash program in the file content of the base image.
[0026] As an optional embodiment of the present invention, in a method for building an image based on a containerized environment of the present invention, building an initial production image based on a base image without a command line interpreter, checking the command line interpreter program in the initial production image and removing it includes:
[0027] Integrate business applications and their dependencies based on a base image without a command line interpreter;
[0028] After the integration is complete, the initial production image is built;
[0029] Check whether the business applications and their dependent programs in the initial production image contain command line interpreter programs. If so, remove them.
[0030] As an optional embodiment of the present invention, in a method for building an image based on a containerized environment of the present invention, checking whether the business application program and its dependency program in the initial production image contain a command line interpreter program includes:
[0031] Check the file contents of the business application and its dependent programs in the initial production image, and search for the specified bash program-specific commands or keywords;
[0032] If the search result is returned, the business application program and its dependency programs in the initial production image contain the bash program; if the search result is not returned, the business application program and its dependency programs in the initial production image do not contain the bash program;
[0033] Optionally, if the search results show that the business application and its dependency programs in the initial production image contain the bash program, then include:
[0034] Check the file contents of the business application and its dependency programs in the initial production image, check for the first line containing a specific bash statement, and check whether / bin / bash is in the line. If so, determine the starting position of the bash program.
[0035] The check continues from the starting position of the bash program. When the exit command identifier exit is found, the end position of the bash program is determined.
[0036] Remove the contents from the start to the end of the bash program in the file contents of the business application and its dependent programs in the initial production image.
[0037] As an optional embodiment of the present invention, in a method for building an image based on a containerized environment of the present invention, checking whether the business application program and its dependency program in the initial production image contain a command line interpreter program includes:
[0038] Check the file contents of the business application and its dependency programs in the initial production image to see whether there is a first line containing a specific bash statement and whether / bin / bash is in the line;
[0039] If yes, the business application and its dependency programs in the initial production image contain a bash program, and the starting position of the bash program is determined to contain a specific bash declaration line;
[0040] The check continues from the starting position of the bash program. When the exit command identifier exit is found, the end position of the bash program is determined.
[0041] Remove the contents from the start to the end of the bash program in the file contents of the business application and its dependent programs in the initial production image.
[0042] As an optional embodiment of the present invention, in a method for building an image based on a containerized environment of the present invention, the following operations are performed while checking and removing the command line interpreter program in the initial production image:
[0043] Check whether the business application and its dependencies contain busybox software. If so, delete it.
[0044] In a second aspect, the present invention provides a device for building an image based on a containerized environment, comprising:
[0045] The image building trigger module receives the trigger instruction to start building the image;
[0046] The basic image building module selects a basic image that matches the business language stack, checks the command line interpreter program in the basic image and removes it to obtain a basic image without a command line interpreter.
[0047] The production image building module builds an initial production image based on a basic image without a command line interpreter, checks the command line interpreter program in the initial production image and removes it to obtain a final production image.
[0048] In a third aspect, the present invention provides a computer-readable recording medium storing a computer-executable program, wherein when the computer-executable program is executed, the method for building an image based on a containerized environment is implemented.
[0049] Compared with the prior art, the present invention has the following beneficial effects:
[0050] The present invention provides a method for building an image based on a containerized environment, and its purpose is to provide a method for building an image without a command line interpreter program in a containerized environment, so as to reduce the risk of attack and improve the security of the application system. By providing a basic image without a command line interpreter program and deleting the command line interpreter program in the production image during the production image building process, the possibility of an attacker using the command line interpreter program to attack can be effectively reduced, thereby improving the security of the application system.
[0051] Specifically, a method for building an image based on a containerized environment of the present invention provides a method for building an image without bash in a containerized environment, including using a basic image without bash and deleting the bash program in the production image, which has the following advantages:
[0052] Advantage 1: Reduced attack surface - Since the bash-free image does not contain bash or shell programs, attackers lack the tools to conduct further attacks after compromising the application, which greatly reduces the attack surface of the system.
[0053] Advantage 2: Improved security - By eliminating bash and shell programs, the present invention improves the security of the containerized environment and reduces the risk of attackers using these programs to perform unauthorized access and malicious operations.
[0054] Advantage 3: Enhanced system protection capabilities - In an environment without bash and shell programs, even if attackers successfully invade the application, it is difficult for them to install backdoors in the system, execute system commands, or establish rebound shells, thereby enhancing the system's protection capabilities.
[0055] Advantage 4: Reduced risk of internal network scanning - The present invention reduces the risk of attackers using compromised applications as a springboard to scan the internal network by removing bash and shell programs.
[0056] Advantage 5: Applicable to existing containerization technology - The method of the present invention can be applied to existing containerization technology, such as Docker, etc., without the need for large-scale modification of existing technology, and is easy to implement and integrate.
[0057] In summary, the method for building an image based on a containerized environment of the present invention effectively reduces the risk of attack and improves the security of the application system by building a bash-free image in a containerized environment, thereby providing an effective solution for the secure deployment of containerized technology. BRIEF DESCRIPTION OF THE DRAWINGS
[0058] Figure 1 A method for building an image based on a containerized environment in the first embodiment of the present invention is a timing diagram for building a production image;
[0059] Figure 2 A specific process example of a device for building an image based on a containerized environment in a first embodiment of the present invention for building a non-bash image in a containerized environment;
[0060] Figure 3 A schematic structural diagram of an electronic device according to a second embodiment of the present invention;
[0061] Figure 4 A schematic diagram of a computer-readable recording medium according to a second embodiment of the present invention. DETAILED DESCRIPTION
[0062] To make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be described clearly and completely in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them.
[0063] Therefore, the following detailed description of the embodiments of the present invention is not intended to limit the scope of the invention claimed for protection, but merely represents some embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0064] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features and technical solutions in the embodiments may be combined with each other.
[0065] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.
[0066] In the description of the present invention, it should be noted that the orientation or positional relationship indicated by the terms "upper", "lower", etc. is based on the orientation or positional relationship shown in the drawings, or the orientation or positional relationship in which the invention product is usually placed when in use, or the orientation or positional relationship commonly understood by those skilled in the art. Such terms are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.
[0067] Embodiment 1
[0068] A method for building an image based on a containerized environment in this embodiment includes:
[0069] Start building the image;
[0070] Select a base image that matches the business language stack, check the command line interpreter program in the base image and remove it, and obtain a base image without a command line interpreter.
[0071] An initial production image is built based on a base image without a command line interpreter, and command line interpreter programs in the initial production image are checked and removed to obtain a final production image.
[0072] The method for building an image based on a containerized environment in this embodiment aims to provide a method for building an image without a command line interpreter program in a containerized environment to reduce the risk of attacks and improve the security of the application system. By providing a basic image without a command line interpreter program and deleting the command line interpreter program in the production image during the production image building process, the possibility of an attacker using the command line interpreter program to attack can be effectively reduced, thereby improving the security of the application system.
[0073] As an optional implementation of this embodiment, in a method for building an image based on a containerized environment in this embodiment, checking the command line interpreter program in the base image and removing it includes:
[0074] Check the file contents of the base image and search for the specified bash program-specific commands or keywords;
[0075] If the search results are returned, the base image contains the bash program, which is removed. If the search results are not returned, the base image does not contain the bash program.
[0076] Bash (Bourne-Again SHell) is a Unix shell and command language interpreter that is the default command line interface in many Linux distributions. Bash provides functions for users to interact with the operating system, including executing commands, programming, and scripting.
[0077] In the security field, application systems are vulnerable to attacks. After attackers break into applications through vulnerabilities, they will try to obtain permissions in the operating environment, install backdoor programs, execute system commands, establish rebound shells, or use them as a springboard to scan internal networks. These operations all rely on the bash program in the operating environment. In the current containerized environment, most base images contain bash or shell programs by default, which provides an attack path for attackers. Even if the production image does not directly use bash or shell programs, attackers may still use these programs to attack because these programs are included in the base image.
[0078] The present embodiment provides a method for building an image based on a containerized environment, which generates a basic image without bash for each language stack. The production image is built by adding a business program to the underlying basic image, ensuring that the production image does not contain a bash program. This can effectively reduce the possibility of attackers using bash or shell programs to attack, thereby improving the security of the application system.
[0079] Furthermore, a method for building an image based on a containerized environment in this embodiment includes: if the search result returned indicates that the base image contains a bash program:
[0080] Check the file contents of the base image to see if there is a first line containing a specific bash statement and if / bin / bash is in that line, determine the starting position of the bash program if so;
[0081] The check continues from the starting position of the bash program. When the exit command identifier exit is found, the end position of the bash program is determined.
[0082] Remove the contents from the start to the end of the bash program in the file content of the base image.
[0083] This embodiment can completely remove the bash program from the file content of the base image through the above process.
[0084] As an optional implementation of this embodiment, in a method for building an image based on a containerized environment in this embodiment, checking the command line interpreter program in the base image and removing it includes:
[0085] Check the file contents of the base image to see if there is a first line containing a specific bash statement and whether / bin / bash is in that line;
[0086] If yes, the base image contains the bash program, and the starting position of the bash program is determined to contain a specific bash declaration line;
[0087] The check continues from the starting position of the bash program. When the exit command identifier exit is found, the end position of the bash program is determined.
[0088] Remove the contents from the start to the end of the bash program in the file content of the base image.
[0089] Furthermore, in a method for building an image based on a containerized environment in this embodiment, building an initial production image based on a basic image without a command line interpreter, and checking and removing the command line interpreter program in the initial production image include:
[0090] Integrate business applications and their dependencies based on a base image without a command line interpreter;
[0091] After the integration is complete, the initial production image is built;
[0092] Check whether the business applications and their dependent programs in the initial production image contain command line interpreter programs. If so, remove them.
[0093] The present embodiment provides a method for building an image based on a containerized environment. For the construction strategy of the production image, a basic image without bash is used, and any possible bash program is deleted during the construction process, thereby ensuring that the production image does not contain the bash program.
[0094] In the method for building an image based on a containerized environment of this embodiment, the bash program in the base image has been checked and removed during the process of building a production image. Therefore, in the subsequent process of building a production image based on the base image, it is only necessary to check whether the business application program and its dependency program in the initial production image contain a command line interpreter program, which specifically includes:
[0095] Check the file contents of the business application and its dependent programs in the initial production image, and search for the specified bash program-specific commands or keywords;
[0096] If the search result is returned, the business application program and its dependency programs in the initial production image contain the bash program. If the search result is not returned, the business application program and its dependency programs in the initial production image do not contain the bash program.
[0097] Optionally, if the search results show that the business application and its dependency programs in the initial production image contain the bash program, then include:
[0098] Check the file contents of the business application and its dependency programs in the initial production image, check for the first line containing a specific bash statement, and check whether / bin / bash is in the line. If so, determine the starting position of the bash program.
[0099] The check continues from the starting position of the bash program. When the exit command identifier exit is found, the end position of the bash program is determined.
[0100] Remove the contents from the start to the end of the bash program in the file contents of the business application and its dependent programs in the initial production image.
[0101] As an optional implementation of this embodiment, in a method for building an image based on a containerized environment in this embodiment, checking whether the business application program and its dependency program in the initial production image contain a command line interpreter program includes:
[0102] Check the file contents of the business application and its dependency programs in the initial production image to see whether there is a first line containing a specific bash statement and whether / bin / bash is in the line;
[0103] If yes, the business application and its dependency programs in the initial production image contain a bash program, and the starting position of the bash program is determined to contain a specific bash declaration line;
[0104] The check continues from the starting position of the bash program. When the exit command identifier exit is found, the end position of the bash program is determined.
[0105] Remove the contents from the start to the end of the bash program in the file contents of the business application and its dependent programs in the initial production image.
[0106] Through the above-mentioned construction method without bash image, the present invention aims to create a safer containerized environment, reduce the attack surface, and improve the overall security of the system.
[0107] As an optional implementation of this embodiment, in a method for building an image based on a containerized environment in this embodiment, the following operations are performed while checking and removing the command line interpreter program in the initial production image:
[0108] Check whether the business application and its dependencies contain busybox software. If so, delete it.
[0109] BusyBox is a software that integrates more than 300 of the most commonly used Linux commands and tools. BusyBox includes some simple tools, such as ls, cat, and echo, etc., as well as some larger and more complex tools, such as grep, find, mount, and telnet. Simply put, BusyBox is like a large toolbox, which integrates and compresses many Linux tools and commands, and also includes the Linux system's built-in shell program. Therefore, a method of building an image based on a containerized environment in this embodiment requires deleting the busybox software contained in the business application and its dependency programs in the production image, thereby further completely removing the shell program.
[0110] See also Figure 1 As shown, a method for building an image based on a containerized environment in this embodiment builds a timing diagram of a production image, including:
[0111] Step 1: Select a base image that matches the business language stack. The base image does not contain bash. Automatically check the bash program and remove it if it exists.
[0112] Step 2: Build a production image. Integrate the business application and its dependencies into a bash-free base image. This process should follow the principle of minimization and only install necessary packages.
[0113] Step 3: Detect and remove the bash program. After integrating the business program, use an automated script or tool to detect whether the image contains the bash program. If bash is detected, it will be automatically removed.
[0114] Step 4: Build the production image
[0115] During the build process, configure the container's security parameters, such as read permissions, network access control, and other security policies, to limit the container's functionality to the minimum required scope.
[0116] Therefore, the method for building an image based on a containerized environment in this embodiment has the following functions:
[0117] Defense Mechanism 1: Reduce Attack Surface. By removing bash, the number of commands and scripts that an attacker can exploit is reduced, thereby reducing the attack surface.
[0118] Defense Mechanism 2: Preventing Command Execution. In an environment without bash, it is difficult for attackers to execute complex commands or scripts, which reduces their ability to perform malicious actions after a successful intrusion.
[0119] Defense mechanism 3: Restrict permissions. The operating permissions of the container are strictly restricted. Even if an attacker gains some level of access, it is difficult for them to gain sufficient permissions to cause serious damage to the system.
[0120] In summary, the prerequisites for applying the method for building an image based on a containerized environment in this embodiment include:
[0121] Premise 1: After compromising an application, attackers usually attempt to gain access to the operating environment, install backdoor programs, execute system commands, establish a rebound shell, or use it as a springboard to scan the internal network.
[0122] Premise 2: These attacks usually rely on bash or shell programs in the running environment.
[0123] Premise 3: In containerization technology, most base images contain bash or shell programs by default, which provides a potential attack path for attackers.
[0124] Premise 4: If the production image does not contain bash or shell programs, it will be difficult for attackers to use these programs to conduct further attacks.
[0125] Therefore, the present invention provides a method for building a bash-free image in a containerized environment, including using a bash-free base image and deleting the bash program in the production image, which has the following advantages:
[0126] Advantage 1: Reduced attack surface - Since the bash-free image does not contain bash or shell programs, attackers lack the tools to conduct further attacks after compromising the application, which greatly reduces the attack surface of the system.
[0127] Advantage 2: Improved security - By eliminating bash and shell programs, the present invention improves the security of the containerized environment and reduces the risk of attackers using these programs to perform unauthorized access and malicious operations.
[0128] Advantage 3: Enhanced system protection capabilities - In an environment without bash and shell programs, even if attackers successfully invade the application, it is difficult for them to install backdoors in the system, execute system commands, or establish rebound shells, thereby enhancing the system's protection capabilities.
[0129] Advantage 4: Reduced risk of internal network scanning - The present invention reduces the risk of attackers using compromised applications as a springboard to scan the internal network by removing bash and shell programs.
[0130] Advantage 5: Applicable to existing containerization technology - The method of the present invention can be applied to existing containerization technology, such as Docker, etc., without the need for large-scale modification of existing technology, and is easy to implement and integrate.
[0131] In summary, the method of building a bash-free image in a containerized environment of the present invention effectively reduces the risk of attack, improves the security of the application system, and provides an effective solution for the secure deployment of containerization technology.
[0132] The present invention also provides a device for building an image based on a containerized environment, including:
[0133] The image building trigger module receives the trigger instruction to start building the image;
[0134] The basic image building module selects a basic image that matches the business language stack, checks the command line interpreter program in the basic image and removes it to obtain a basic image without a command line interpreter.
[0135] The production image building module builds an initial production image based on a basic image without a command line interpreter, checks the command line interpreter program in the initial production image and removes it to obtain a final production image.
[0136] The device for building an image based on a containerized environment in this embodiment aims to provide a technical solution for building an image without a command line interpreter program in a containerized environment, so as to reduce the risk of attack and improve the security of the application system. By providing a basic image without a command line interpreter program and deleting the command line interpreter program in the production image during the production image building process, the possibility of an attacker using the command line interpreter program to attack can be effectively reduced, thereby improving the security of the application system.
[0137] See also Figure 2 , a specific process example of a device for building images based on a containerized environment in this embodiment to build a bash-free image in a containerized environment. A device for building images based on a containerized environment in this embodiment generates a bash-free basic image for each language stack, and the production image is constructed by the underlying basic image plus the business program, ensuring that the production image does not contain the bash program, which can effectively reduce the possibility of attackers using bash or shell programs to attack, thereby improving the security of the application system.
[0138] Embodiment 2
[0139] The following describes an electronic device embodiment of the present invention, which can be regarded as a specific physical implementation of the method and device embodiments of the present invention. The details described in the electronic device embodiment of the present invention should be regarded as a supplement to the above method or device embodiments; details not disclosed in the electronic device embodiment of the present invention can be implemented with reference to the above method or device embodiments.
[0140] Figure 3 It is a structural diagram of an electronic device of an embodiment of the present invention, which includes a processor and a memory, wherein the memory is used to store a computer executable program, and when the computer program is executed by the processor, the processor executes a method for building an image based on a containerized environment according to the first embodiment.
[0141] like Figure 3 As shown, the electronic device is presented in the form of a general computing device. The processor may be one or more and work in coordination. The present invention does not exclude distributed processing, that is, the processor may be dispersed in different physical devices. The electronic device of the present invention is not limited to a single entity, but may also be the sum of multiple physical devices.
[0142] The memory stores a computer executable program, which is usually a machine-readable code. The computer-readable program can be executed by the processor to enable the electronic device to perform the method of the present invention, or at least part of the steps in the method.
[0143] The memory includes a volatile memory, such as a random access memory unit (RAM) and / or a cache memory unit, and may also be a non-volatile memory, such as a read-only memory unit (ROM).
[0144] Optionally, in this embodiment, the electronic device further includes an I / O interface, which is used for the electronic device to exchange data with an external device. The I / O interface can represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of a variety of bus structures.
[0145] It should be understood that Figure 3 The electronic device shown is only an example of the present invention, and the electronic device of the present invention may also include elements or components not shown in the above examples. For example, some electronic devices also include display units such as display screens, and some electronic devices also include human-computer interaction elements such as buttons, keyboards, etc. As long as the electronic device can execute the computer-readable program in the memory to implement the method of the present invention or at least part of the steps of the method, it can be considered as an electronic device covered by the present invention.
[0146] Figure 4 Schematic diagram of a computer readable recording medium according to an embodiment of the present invention. Figure 4 As shown, a computer executable program is stored in a computer-readable recording medium, and when the computer executable program is executed, a method for building an image based on a containerized environment in the first embodiment of the present invention is implemented. The computer-readable recording medium may include a data signal propagated in a baseband or as part of a carrier, which carries a readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable recording medium may also be any readable medium other than a readable recording medium, which may send, propagate, or transmit a program for use by or in combination with an instruction execution system, device, or device. The program code contained on the readable recording medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.
[0147] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, etc., and conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).
[0148] Through the above description of the implementation mode, it is easy for those skilled in the art to understand that the present invention can be implemented by hardware capable of executing a specific computer program, such as the system of the present invention, and the electronic processing unit, server, client, mobile phone, control unit, processor, etc. contained in the system. The present invention can also be implemented by computer software that executes the method of the present invention, such as control software executed by a microprocessor, an electronic control unit, a client, a server, etc. However, it should be noted that the computer software that executes the method of the present invention is not limited to being executed by one or a specific hardware entity, and it can also be implemented in a distributed manner by unspecified specific hardware. For computer software, the software product can be stored in a computer-readable recording medium (which can be a CD-ROM, a USB flash drive, a mobile disk, etc.), and can also be distributed and stored on the network, as long as it enables the electronic device to execute the method according to the present invention.
[0149] The above embodiments are only used to illustrate the present invention and are not intended to limit the technical solutions described in the present invention. Although the present invention has been described in detail with reference to the above embodiments, the present invention is not limited to the above specific implementation methods. Therefore, any modification or equivalent replacement of the present invention; and all technical solutions and improvements thereof that do not depart from the spirit and scope of the invention are included in the scope of the claims of the present invention.
Claims
1. A method for building an image based on a containerized environment, characterized in that: include: Start building the image; Select a base image that matches the business language stack, check the command line interpreter program in the base image and remove it, and obtain a base image without a command line interpreter. An initial production image is built based on a base image without a command line interpreter, and command line interpreter programs in the initial production image are checked and removed to obtain a final production image.
2. According to a method for building an image based on a containerized environment according to claim 1, it is characterized in that: The checking and removing of the command line interpreter program in the base image includes: Check the file contents of the base image and search for the specified bash program-specific commands or keywords; If the search results are returned, the base image contains the bash program, which is removed. If the search results are not returned, the base image does not contain the bash program.
3. The method for building an image based on a containerized environment according to claim 2, characterized in that: If the search result shows that the base image contains the bash program, it includes: Check the file contents of the base image to see if there is a first line containing a specific bash statement and if / bin / bash is in that line, determine the starting position of the bash program if so; The check continues from the starting position of the bash program. When the exit command identifier exit is found, the end position of the bash program is determined. Remove the contents from the start to the end of the bash program in the file content of the base image.
4. The method for building an image based on a containerized environment according to claim 1, characterized in that: The checking and removing of the command line interpreter program in the base image includes: Check the file contents of the base image to see if there is a first line containing a specific bash statement and whether / bin / bash is in that line; If yes, the base image contains the bash program, and the starting position of the bash program is determined to contain a specific bash declaration line; The process continues to check downward from the starting position of the bash program. When the exit command identifier "exit" is found, the end position of the bash program is determined. Remove the contents from the start to the end of the bash program in the file content of the base image.
5. The method for building an image based on a containerized environment according to claim 1, characterized in that: The step of building an initial production image based on a base image without a command line interpreter and checking and removing the command line interpreter program in the initial production image comprises: Integrate business applications and their dependencies based on a base image without a command line interpreter; After the integration is completed, the initial production image is built; Check whether the business applications and their dependent programs in the initial production image contain command line interpreter programs. If so, remove them.
6. The method for building an image based on a containerized environment according to claim 5, characterized in that: The step of checking whether the business application program and its dependency programs in the initial production image contain a command line interpreter program includes: Check the file contents of the business application and its dependent programs in the initial production image, and search for the specified bash program-specific commands or keywords; If the search result is returned, the business application program and its dependency programs in the initial production image contain the bash program; if the search result is not returned, the business application program and its dependency programs in the initial production image do not contain the bash program; Optionally, if the search results show that the business application and its dependency programs in the initial production image contain the bash program, then include: Check the file contents of the business application and its dependency programs in the initial production image, check for the first line containing a specific bash statement, and check whether / bin / bash is in the line. If so, determine the starting position of the bash program. The process continues to check downward from the starting position of the bash program. When the exit command identifier "exit" is found, the end position of the bash program is determined. Remove the contents from the start to the end of the bash program in the file contents of the business application and its dependent programs in the initial production image.
7. The method for building an image based on a containerized environment according to claim 5, characterized in that: The step of checking whether the business application program and its dependency programs in the initial production image contain a command line interpreter program includes: Check the file contents of the business application and its dependency programs in the initial production image to see whether there is a first line containing a specific bash statement and whether / bin / bash is in the line; If yes, the business application and its dependency programs in the initial production image contain a bash program, and the starting position of the bash program is determined to contain a specific bash declaration line; The process continues to check downward from the starting position of the bash program. When the exit command identifier "exit" is found, the end position of the bash program is determined. Remove the contents from the start to the end of the bash program in the file contents of the business application and its dependent programs in the initial production image.
8. The method for building an image based on a containerized environment according to claim 1, characterized in that: The following operations are performed while checking and removing the command line interpreter program in the initial production image: Check whether the business application and its dependencies contain busybox software. If so, delete it.
9. A device for building an image based on a containerized environment, characterized in that: include: The image building trigger module receives the trigger instruction to start building the image; The basic image building module selects a basic image that matches the business language stack, checks the command line interpreter program in the basic image and removes it to obtain a basic image without a command line interpreter. The production image building module builds an initial production image based on a basic image without a command line interpreter, checks the command line interpreter program in the initial production image and removes it to obtain a final production image.
10. A computer-readable recording medium storing a computer-executable program, characterized in that: When the computer executable program is executed, a method for building an image based on a containerized environment as described in any one of claims 1 to 8 is implemented.