Container scanning method, device, equipment, medium and product

Abstract

The invention provides a container scanning method and device, equipment, a medium and a product, and is applied to a container scanner, the container scanner is deployed in a first host, the first host is deployed with a target container, and the method comprises the following steps: obtaining file handle information of a namespace of the target container, and creating a container scanning thread in a host process of the first host; according to the file handle information of the namespace of the target container, switching the container scanning thread to the namespace of the target container, so that the container scanning thread executes a container scanning task in the target container; and receiving a scanning result sent by the container scanning thread, and switching the container scanning thread to the namespace of the host process according to the file handle information of the namespace of the target container. In the method, the complete file system of the target container can be covered, and the integrity of container scanning is realized. The method has good compatibility for different container engines, so that container scanning is more flexible and efficient.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a container scanning method, device, electronic device, computer-readable storage medium, and computer program product. Background Art

[0002] With the continuous development of computer technology, especially virtualization technology, containers have emerged. Containers are lightweight, portable software operating environments that package applications and their dependencies together and can run in any environment that supports containers, allowing applications to maintain a consistent operating state in different operating environments.

[0003] Comprehensive and accurate scanning of containers helps ensure container security. Generally, the industry can use container management tools to scan containers. However, the above method is difficult to completely cover all files in the container, and there are also issues with container engine compatibility, so the integrity and compatibility of container scanning are poor. Summary of the invention

[0004] The present application provides a container scanning method. The method can improve the integrity and compatibility of container scanning, making container scanning more flexible and efficient. The present application also provides a device, an electronic device, a computer-readable storage medium, and a computer program product corresponding to the above method.

[0005] In a first aspect, the present application provides a container scanning method, which is applied to a container scanner, wherein the container scanner is deployed on a first host, and a target container is deployed on the first host. The method includes:

[0006] Obtaining file handle information of the namespace of the target container, and creating a container scanning thread in the main process of the first host;

[0007] According to the file handle information of the namespace of the target container, switching the container scanning thread to the namespace of the target container, so that the container scanning thread performs the container scanning task in the target container;

[0008] A scanning result sent by the container scanning thread is received, and, according to the file handle information of the namespace of the target container, the container scanning thread is switched to the namespace of the main process.

[0009] In a second aspect, the present application provides a container scanning device, wherein the device is deployed on a container scanner, wherein the container scanner is deployed on a first host, and a target container is deployed on the first host. The device includes:

[0010] An acquisition module, used to acquire file handle information of the namespace of the target container;

[0011] A creation module, used to create a container scanning thread in the main process of the first host;

[0012] A switching module, configured to switch the container scanning thread to the namespace of the target container according to the file handle information of the namespace of the target container, so that the container scanning thread performs a container scanning task in the target container;

[0013] A communication module, used to receive the scanning result sent by the container scanning thread;

[0014] The switching module is further configured to switch the container scanning thread to the namespace of the main process according to the file handle information of the namespace of the target container.

[0015] In a third aspect, the present application provides an electronic device, the electronic device comprising a processor and a memory. The processor and the memory communicate with each other. The processor is used to execute instructions stored in the memory, so that the electronic device performs the container scanning method in the first aspect or any implementation of the first aspect.

[0016] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, wherein the instructions instruct an electronic device to execute the container scanning method described in the first aspect or any one of the implementations of the first aspect.

[0017] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on an electronic device, enables the electronic device to execute the container scanning method described in the first aspect or any one of the implementations of the first aspect.

[0018] Based on the implementations provided in the above aspects, this application can also be further combined to provide more implementations.

[0019] It can be seen from the above technical solutions that this application has the following advantages:

[0020] The present application provides a container scanning method, which is applied to a container scanner, which is deployed on a first host, and a target container is deployed on the first host. The container scanner first obtains the file handle information of the namespace of the target container, and creates a container scanning thread in the main process of the first host. The container scanner switches the container scanning thread to the namespace of the target container according to the file handle information of the namespace of the target container, so that the container scanning thread performs the container scanning task in the target container. Then, the container scanner receives the scanning result sent by the container scanning thread, and switches the container scanning thread to the namespace of the main process according to the file handle information of the namespace of the target container.

[0021] In this method, a container scanning thread is created in the main process of the host machine (i.e., the first host), and the container scanning thread is switched to the namespace of the target container to be scanned, so as to achieve direct interaction with the internal environment of the target container. In this way, the container scanning task can be regarded as a task to scan inside the host, which can cover the complete file system of the target container and improve the integrity of the container scanning. At the same time, thread switching is performed through the file handle information of the namespace of the target container, which does not rely on the interface provided by the container engine and has good compatibility with different container engines, making container scanning more flexible and efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical method of the embodiments of the present application, the drawings required for use in the embodiments are briefly introduced below.

[0023] Figure 1 A schematic diagram of the architecture of a container scanner provided in an embodiment of the present application;

[0024] Figure 2 A schematic diagram of a process flow of a container scanning method provided in an embodiment of the present application;

[0025] Figure 3 A schematic diagram of the structure of a container scanning device provided in an embodiment of the present application;

[0026] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] The terms "first" and "second" in the embodiments of the present application are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0028] First, some technical terms and application scenarios involved in the embodiments of this application are introduced.

[0029] With the continuous development of computer technology, especially virtualization technology, containers have emerged. Containers are lightweight, portable software operating environments that package applications and their dependencies together and can run in any environment that supports containers, allowing applications to maintain a consistent operating state in different operating environments.

[0030] In a containerized environment, scanning for container vulnerabilities helps ensure container security. Container vulnerabilities can be understood as security vulnerabilities in containers. In related technologies, container management tools are usually used to scan containers. Container management tools can identify container assets, scan container data, and identify security vulnerabilities in containers through the application programming interface (API) provided by the container engine during the container building and container deployment stages.

[0031] However, the above method has the following two defects: First, for data mounted in a special way, such as ConfigMap for storing configuration data or Secrets for storing key data, since the above data is not directly reflected in the file system view of the container, it is difficult to cover the above configuration data or key data when scanning the container through the container management tool, and the integrity of the container scan is poor.

[0032] In addition, with the diversification of container technology, containers provided by different container engines may have different file system organizational structures. At the same time, when scanning containers through container management tools, they rely on the API capabilities provided by the container engine. Therefore, container management tools usually only support use in specific container engines, and their compatibility and applicability are poor.

[0033] In view of this, the present application provides a container scanning method, which is applied to a container scanner, which is deployed on a first host, and a target container is deployed on the first host. The container scanner first obtains the file handle information of the namespace of the target container, and creates a container scanning thread in the main process of the first host. The container scanner switches the container scanning thread to the namespace of the target container according to the file handle information of the namespace of the target container, so that the container scanning thread performs the container scanning task in the target container. Then, the container scanner receives the scanning result sent by the container scanning thread, and switches the container scanning thread to the namespace of the main process according to the file handle information of the namespace of the target container.

[0034] In this method, a container scanning thread is created in the main process of the host machine (i.e., the first host), and the container scanning thread is switched to the namespace of the target container to be scanned, so as to achieve direct interaction with the internal environment of the target container. In this way, the container scanning task can be regarded as a task to scan inside the host, which can cover the complete file system of the target container and achieve the integrity of the container scanning. At the same time, thread switching is performed through the file handle information of the namespace of the target container, which does not rely on the interface provided by the container engine and has good compatibility with different container engines, making container scanning more flexible and efficient.

[0035] To facilitate understanding of the technical solution provided by the embodiments of the present application, it will be described below with reference to the accompanying drawings.

[0036] See also Figure 1 The schematic diagram of the architecture of a container scanner provided by an embodiment of the present application is shown, in which the container scanner is deployed in a first host 10, and the first host 10 is also deployed with at least one container, and the at least one container includes a target container. Among them, the first host 10, which can also be called a host machine, can be understood as a physical computer or a virtual machine (VM) running at least one container. In other words, the first host 10 provides necessary hardware resources for at least one container, such as providing a central processing unit (CPU), memory, storage interface, network interface, etc. At least one container is isolated from each other on the first host 10, shares the kernel of the first host 10, and runs their own applications and dependent environments respectively.

[0037] In an embodiment of the present application, the container scanner runs in namespace 11, and the target container runs in namespace 12. The namespace is used to implement isolation and resource management of containers running in the first host 10. By allocating different namespaces to different containers, resource isolation and restrictions between different containers and between the container and the first host 10 are ensured, and independent operating environments are provided for different containers, so that processes and resources within the container are isolated from the outside world, thereby improving overall security and stability. Specifically, the namespace can include multiple types of namespaces, and different types of namespaces are used to isolate different resources. For example, a network namespace is used to isolate network resources, and a mount namespace is used to isolate file systems.

[0038] In other words, namespace 11 can be understood as the namespace used by the first host 10, that is, namespace 11 is the namespace where the main process of the first host 10 is located, the container scanner runs in the main process 111 of the first host 10, and namespace 12 is a namespace different from namespace 11.

[0039] In the embodiment of the present application, the container scanner obtains the file handle information of the namespace 12 of the target container, and creates a container scanning thread 112 in the main process 111 of the first host. The container scanning thread 112 can be used to perform the container scanning task. Then, the container scanner switches the container scanning thread 112 from the namespace 11 of the container scanner to the namespace 12 of the target container according to the file handle information of the namespace 12 of the target container.

[0040] By injecting the container scanning thread 112 into the namespace 12 of the target container, the container scanning thread 112 executes the container scanning task in the target container, which is equivalent to scanning in the host. It can access the file system 121 of the target container and scan the file data in the file system 121 without calling the API provided by the container engine.

[0041] Furthermore, in the embodiment of the present application, a shared memory 13 may be provided between the namespace 11 of the container scanner and the namespace 12 of the target container, and the container scanner may send a scan command to the container scanning thread 112 running in the namespace 12 of the target container through the shared memory 13. When the container scanning thread 112 completes the scanning task, it may also send the scanning result to the container scanner through the shared memory 13, and the container scanner may also switch the container scanning process 112 back to the namespace 11 of the container scanner to complete the scanning of the target container.

[0042] In this way, by injecting the container scanning process into the namespace of the target container, the container scanning process can directly access the file data in the target container, shielding the differences in the upper-level container form and container engine, and improving the adaptability and compatibility of container scanning.

[0043] Based on the architectural diagram of the container scanner provided above, the present application embodiment also provides a container scanning method. Figure 2 The flowchart of a container scanning method provided by an embodiment of the present application is shown. The method can be applied to a container scanner. The container scanner is deployed on a first host. The first host also has a target container deployed thereon. The method specifically includes:

[0044] S201: Obtain file handle information of a namespace of a target container, and create a container scanning thread in a main process of a first host.

[0045] The target container can be understood as a container for which a container scanning requirement exists and is to be scanned. In an embodiment of the present application, at least one container can be deployed in the first host, and the target container can be any container running in the at least one container in the first host.

[0046] File handle information (file handle) can be understood as an object used to identify and reference a file. In some embodiments, the file handle information may include one or more of a file descriptor, a file pointer, file status information, file attributes, and a file type. Generally, when a file is opened, the file handle information of the file can be created. In this way, by creating the file handle information, it is indicated that an instance of opening the file is indicated.

[0047] In the embodiment of the present application, since the container scanning thread involves switching between different namespaces, it is necessary to obtain the file handle information of the target container's namespace to ensure that the container scanning thread can smoothly switch between the namespace of the target container and the namespace of the main process, thereby ensuring stability and reliability in the actual application process.

[0048] The following is an explanation of the specific process of the container scanner obtaining file handle information. In some possible implementations, in order to shield the differences between different container engines and solve the problem of difficulty in locating the target container under different container engines, the container can be regarded as a process, and the file handle information can be obtained by collecting the process.

[0049] Specifically, the container scanner can obtain the process information running on the first host, determine the process information of the target container from the process information running on the first host according to the process link of the target container, and then scan the namespace directory corresponding to the process information of the target container to obtain the file handle information of the namespace of the target container.

[0050] The process information running on the first host can be used to represent information related to the process running on the first host, for example, the process information can include a process name, a process identifier, process running information, etc. In some possible implementations, first, the virtual file system of the first host is traversed, for example, the / proc file system is traversed, and the / proc directory is accessed, wherein each subdirectory in the / proc directory represents a process, and the subdirectory name is the process identifier (PID). Then, the cmdline file in each subdirectory is read to obtain the process information running on the first host.

[0051] Since the container is regarded as a process in the embodiment of the present application, the nested relationship between the multiple containers running on the first host can be regarded as a process link. From the process information running on the first host, the process information matching the process link of the target container is screened out, and then the process information of the target container is determined to locate the target container.

[0052] In a specific implementation, the container scanner may determine, among the process information running on the first host, process information that matches a pre-configured collection rule as the process information of the target container.

[0053] Among them, the collection rule is used to describe the process link of the target container. That is to say, in the embodiment of the present application, corresponding collection rules are configured for the process link of at least one container running on the first host to form a collection rule set. In this way, when there is a need to scan the target container, the collection rule corresponding to the target container is determined from the collection rule set, and the process information running on the first host is matched with the collection rule corresponding to the target container, and the successfully matched process information is determined as the process information of the target container.

[0054] In an embodiment of the present application, by analyzing the process information on the first host and combining it with the collection rules, the running container instance is identified, and the container assets are identified without relying on the API provided by the container engine or a specific container management tool, thereby solving the compatibility problem of adapting the container engine and achieving efficient compatibility identification for container assets.

[0055] In some possible implementations, the collection rules may include the process information of the target container, the process information of the parent container of the target container, and the process information of the root container of the target container. The root container can be understood as a container instance started directly from a container image, that is, a container that serves as the starting point of the container hierarchy. The parent container can be understood as a container that has a parent-child container relationship with the target container, that is, the target container runs inside the parent container.

[0056] In some embodiments, the process information of the target container may be the process name of the target container, the process information of the parent container of the target container may be the process name of the parent container of the target container, and the process information of the root container of the target container may be the process name of the root container of the target container. In this case, the collection rules may be expressed in the following forms:

[0057] root_process_name: root container process name

[0058] parent_process_name: parent container process name

[0059] target_process_name: target container process name

[0060] When matching collection rules, you can first match the process name of the root container of the target container, then match any number of non-specific characters (such as other process names), then match the process name of the parent container of the target container, match any number of non-specific characters again, and finally match the process name of the target container.

[0061] That is to say, the process of matching the process information of the first host with the collection rule can be represented by the following regular expression: $(root_process_name).*? $(parent_process_name).*? $(target_process_name). Among them, target_process_name represents the process name of the target container, parent_process_name represents the process name of the parent container of the target container, and root_process_name represents the process name of the root container of the target container. By matching the process information of the first host with the regular expression, the process information whose process link conforms to the regular expression is determined as the process information of the target container, thereby realizing the identification of the target container.

[0062] After identifying the target container, the container scanner can further obtain the file handle information of the target container's namespace based on the process information of the target container. In specific implementation, the container scanner can scan the namespace directory corresponding to the process information of the target container to determine the file path of the target container's namespace, and then, according to the file path of the target container's namespace, open the file of the target container's namespace in the namespace of the main process to obtain the file handle information of the target container's namespace.

[0063] Among them, the namespace directory corresponding to the process information of the target container can be understood as the directory corresponding to the PID of the target container, and the file path can be understood as a string representing the location of the file, which is used to locate and access resources in the file system. In some embodiments, the files of the namespace of the target container may include files of the mount namespace (mnt fd files) and files of the network namespace (net fd files), and the file path of the namespace of the target container may include the file path of the mnt fd file and the file path of the net fd file.

[0064] The main process of the first host can be understood as the first user-level process initialized when the operating system of the first host is started. By opening the file of the namespace of the target container in the namespace of the main process and keeping the file of the namespace of the target container open, the file handle information of the namespace of the target container can be stored in the memory of the namespace of the main process, and the container scanner can obtain the file handle information of the namespace of the target container.

[0065] For example, in the namespace of the main process, the mnt fd file is opened through / proc / {pid} / ns / mnt, the net fd file is opened through / proc / {pid} / ns / net, and the mnt fd file and the net fd file are kept open, so that the container scanner obtains the file handle information of the namespace of the target container.

[0066] In conjunction with specific examples, in some examples, the execution code for the container scanner to obtain the file handle information of the namespace of the target container is as follows:

[0067] [root@id~]#ps-ef|grep super

[0068] root 11106 11105 0Sep05 pts / 2 00:00:05. / supervisord

[0069] [root@id 11106]#cd / proc / 11106 / ns

[0070] [root@id ns]#ll

[0071] total 0

[0072] lrwxrwxrwx 1root root 0Sep 11 16:54ipc->ipc:[4026532452]

[0073] lrwxrwxrwx 1root root 0Sep 5 20:53mnt->mnt:[4026532450]

[0074] lrwxrwxrwx 1root root 0Sep 9 15:24net->net:[4026532455]

[0075] lrwxrwxrwx 1root root 0Sep 11 16:54pid->pid:[4026532453]

[0076] lrwxrwxrwx 1root root 0Sep 18 20:32user->user:[4026531837]

[0077] lrwxrwxrwx 1root root 0Sep 11 16:54uts->uts:[4026532451]

[0078] Among them, the PID of the target container is 11106. The container scanner can scan the directory / proc / 11106 / ns and record the file path of the mnt fd file and the file path of the net fd file. Then, according to the file path of the mnt fd file and the file path of the netfd file, the mnt fd file and the net fd file are opened to obtain the file handle information of the namespace of the target container.

[0079] In addition, the container scanner can also create a container scanning thread. The container scanning thread can be understood as a thread for executing container scanning tasks. In the embodiment of the present application, in response to the scanning requirements of the target container, the container scanner creates a container scanning thread in the main process of the first host, that is, creates a container scanning thread in the namespace of the main process.

[0080] S202: Switch the container scanning thread to the namespace of the target container according to the file handle information of the namespace of the target container, so that the container scanning thread executes the container scanning task in the target container.

[0081] In an embodiment of the present application, according to the file handle information of the namespace of the target container, the container scanning thread created in the namespace of the main process is injected into the namespace of the target container, so that the container scanning thread can run in the namespace of the target container.

[0082] In the specific implementation, considering that the container scanner needs to switch the namespace of the container scanning thread, the main thread of the container scanner can be locked. For example, the main thread of the container scanner is locked through runtime.LockOSThread() to ensure that the container scanning thread can switch the namespace normally and will not be scheduled by other coroutines.

[0083] Furthermore, before executing the namespace switch of the container scanning thread, it is also necessary to perform an unshare operation to ensure the successful switching of the namespace. Among them, the unshare operation can create a new independent environment for the calling thread without affecting other threads, so that the calling thread can perform operations in an isolated environment. That is, after creating a container scanning thread in the namespace of the main process, the unshare operation is performed to create a new namespace for the container scanning thread, and then the container scanning thread is switched from the new namespace to the namespace of the target container. Considering that threads usually share information such as mount points (mnt), in some embodiments, the unshare operation can be performed only on mnt, that is, only a new mount namespace is created for the container scanning thread.

[0084] Next, the file handle information of the namespace of the target container is used as an input parameter, a system call for switching the namespace is executed, and the container scanning thread is switched to the namespace of the target container.

[0085] That is to say, the namespace switching operation for the container scanning thread can be implemented by a system call for switching namespaces. The system call for switching namespaces can be a setns operation, which is a system call operation used to add a thread to an existing namespace. Since the file handle information of the namespace of the target container has been obtained, the namespace of the target container already exists. By using the file handle information of the namespace of the target container as an input parameter to perform the setns operation, the container scanning thread can change the current namespace and enter the namespace of other processes (i.e., the target container), and share the same resource view with the switched process.

[0086] In some possible implementations, the namespace of the main process may have a shared memory with the namespace of the target container, that is, there may be a shared memory between the namespace of the main process and the namespace of the target container. In this case, the container scanner may send a scan command to the container scanning thread through the shared memory.

[0087] The scanning command may be a command that instructs the container scanning thread to execute different types of scanning logic in the target container, such as scanning commands such as cat, ls, and find. In this way, the scanning command is transmitted through the shared memory to implement scanning of the target container.

[0088] By switching the container scanning thread, the container scanning thread is injected into the namespace of the target container, so that the container scanning thread can directly interact with the internal environment of the target container, allowing the container scanning thread to directly access the complete file system in the target container, including temporary files generated at runtime, hidden files, and files with special permissions, etc., to achieve comprehensive coverage of container scanning, enhance the flexibility and scope of application of container scanning, and at the same time, decouple from the underlying container engine to achieve compatibility coverage of different types of container engines.

[0089] S203: receiving the scanning result sent by the container scanning thread, and switching the container scanning thread to the namespace of the main process according to the file handle information of the namespace of the target container.

[0090] The scanning result can be understood as data collected after scanning the target container. For example, the scanning result can include vulnerability data of the target container, configuration file data of the target container, etc.

[0091] In some possible implementations, a namespace of the main process may have a shared memory with a namespace of the target container. In this case, the container scanner may receive the scanning result sent by the container scanning thread from the shared memory.

[0092] In other words, the container scanning thread can transmit the data collected after scanning the target container back to the namespace of the main process through shared memory, reducing the complexity of cross-namespace communication while ensuring the efficiency and security of data transmission.

[0093] Furthermore, since the files of the target container's namespace are opened in the namespace of the main process (e.g., mntfd files and netfd files), the container scanner can obtain the file handle information of the target container's namespace in the memory of the namespace of the main process. Thus, by retaining the file handle information of the target container's namespace and taking the file handle information of the target container's namespace as an input parameter, the system call for switching the namespace (i.e., the setns operation) is executed again to switch the container scanning thread to the namespace of the main process. Furthermore, after the container scanning thread completes the scanning task, the container scanning thread is switched back to the namespace of the main process to implement a container scan.

[0094] In conjunction with specific examples, in some examples, the execution code for the container scanner to switch the namespace is as follows:

[0095] MainTid:=strconv.Itoa(unix.Gettid())

[0096] netFS,err:=os.Open(fmt.Sprintf(" / proc / %s / ns / net",MainTid)

[0097] mntFS,err:=os.Open(fmt.Sprintf(" / proc / %s / ns / mnt",MainTid)

[0098] …

[0099] netfs,_:=os.Open(" / proc / %s / ns / mnt",11106)

[0100] mntfs,_:=os.Open(" / proc / %s / ns / net",11106)

[0101] syscall.Unshare(syscall.CLONE_NEWNS)

[0102] unix.Setns(netfs.Fd(),syscall.CLONE_NEWNS)

[0103] unix.Setns(mntfs.Fd(),syscall.CLONE_NEWNET)

[0104] Among them, the PID of the target container is 11106, syscall.Unshare(syscall.CLONE_NEWNS) is used to perform the unshare operation, unix.Setns(netfs.Fd(),syscall.CLONE_NEWNS) is used to switch the container scanning thread to the namespace of the target container, and unix.Setns(mntfs.Fd(),syscall.CLONE_NEWNET) is used to switch the container scanning thread back to the namespace of the main process.

[0105] Furthermore, after the container scanner switches the container scanning thread to the namespace of the main process according to the file handle information of the namespace of the target container, the working directory of the container scanning thread may also be switched to the working directory of the main process.

[0106] In an embodiment of the present application, considering that after the container scanning thread is switched back to the namespace of the main process, the working directory of the container scanning thread will usually default to the root directory, therefore, the working directory is switched together, for example, by switching the working directory through os.Chdir(originWorkDir) to avoid affecting the normal operation of the container scanner.

[0107] In this method, a container scanning thread is created in the main process of the host machine (i.e., the first host), and the container scanning thread is switched to the namespace of the target container to be scanned, so as to achieve direct interaction with the internal environment of the target container. In this way, the container scanning task can be regarded as a task to scan inside the host, which can cover the complete file system of the target container and achieve the integrity of the container scanning. At the same time, thread switching is performed through the file handle information of the namespace of the target container, which does not rely on the interface provided by the container engine and has good compatibility with different container engines, making container scanning more flexible and efficient.

[0108] Furthermore, the container scanning method provided in the embodiment of the present application can be applied to the field of scanning container images. By integrating and aggregating the scanning results obtained by scanning the container, the purpose of scanning the container image can be achieved.

[0109] Combination of the above Figure 1 and Figure 2The container scanning method provided in the embodiment of the present application is introduced in detail. The device and equipment provided in the embodiment of the present application will be introduced in conjunction with the accompanying drawings.

[0110] See also Figure 3 The structural schematic diagram of the container scanning device shown in FIG. 30 includes:

[0111] An acquisition module 301 is used to acquire file handle information of the namespace of the target container;

[0112] A creation module 302, configured to create a container scanning thread in a main process of the first host;

[0113] A switching module 303, configured to switch the container scanning thread to the namespace of the target container according to the file handle information of the namespace of the target container, so that the container scanning thread performs the container scanning task in the target container;

[0114] The communication module 304 is used to receive the scanning result sent by the container scanning thread;

[0115] The switching module 303 is further configured to switch the container scanning thread to the namespace of the main process according to the file handle information of the namespace of the target container.

[0116] In some possible implementations, the switching module 303 is specifically configured to:

[0117] Using the file handle information of the namespace of the target container as an input parameter, executing a system call for switching the namespace, and switching the container scanning thread to the namespace of the target container; or,

[0118] The file handle information of the namespace of the target container is used as an input parameter, and the system call for switching the namespace is executed again to switch the container scanning thread to the namespace of the main process.

[0119] In some possible implementations, the acquisition module 301 is specifically used to:

[0120] Obtaining process information running on the first host;

[0121] Determine, according to the process link of the target container, the process information of the target container from the process information running on the first host;

[0122] Scan a namespace directory corresponding to the process information of the target container to obtain file handle information of the namespace of the target container.

[0123] In some possible implementations, the acquisition module 301 is specifically used to:

[0124] Determine the process information of the process running on the first host that matches the pre-configured collection rule as the process information of the target container; wherein the collection rule is used to describe the process link of the target container.

[0125] In some possible implementations, the collection rule includes process information of the target container, process information of a parent container of the target container, and process information of a root container of the target container.

[0126] In some possible implementations, the acquisition module 301 is specifically used to:

[0127] Scan the namespace directory corresponding to the process information of the target container to determine the file path of the namespace of the target container;

[0128] According to the file path of the namespace of the target container, in the namespace of the main process, open the file of the namespace of the target container, and obtain the file handle information of the namespace of the target container.

[0129] In some possible implementations, a shared memory is provided between the namespace of the main process and the namespace of the target container; and the communication module 304 is further used for:

[0130] A scan command is sent to the container scan thread through the shared memory.

[0131] In some possible implementations, there is a shared memory between the namespace of the main process and the namespace of the target container; the communication module 304 is specifically used to:

[0132] A scan result sent by the container scanning thread is received from the shared memory.

[0133] In some possible implementations, the switching module 303 is further configured to:

[0134] Switch the working directory of the container scanning thread to the working directory of the main process.

[0135] The container scanning device 30 according to the embodiment of the present application may correspond to executing the method described in the embodiment of the present application, and the above and other operations and / or functions of each module / unit of the container scanning device 30 are respectively to implement Figure 2 For the sake of brevity, the corresponding processes of each method in the illustrated embodiment are not described in detail here.

[0136] The present application also provides an electronic device. The electronic device is specifically used to implement Figure 3 The function of the container scanning device 30 in the illustrated embodiment.

[0137] Figure 4 A schematic diagram of the structure of an electronic device 400 is provided. Figure 4 As shown, the electronic device 400 includes a bus 401, a processor 402, a communication interface 403 and a memory 404. The processor 402, the memory 404 and the communication interface 403 communicate with each other via the bus 401.

[0138] The bus 401 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0139] The processor 402 may be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0140] The communication interface 403 is used for communicating with the outside. For example, the communication interface 403 can be used for communicating with a terminal.

[0141] The memory 404 may include a volatile memory, such as a random access memory (RAM). The memory 404 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0142] The memory 404 stores executable codes, and the processor 402 executes the executable codes to perform the aforementioned container scanning method.

[0143] Specifically, in implementing Figure 3In the case of the embodiment shown, and Figure 3 When each module or unit of the container scanning device 30 described in the embodiment is implemented by software, the execution Figure 3 The software or program code required for the functions of each module / unit in the system may be partially or completely stored in the memory 404. The processor 402 executes the program code corresponding to each unit stored in the memory 404 to perform the above-mentioned container scanning method.

[0144] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center that contains one or more available media. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the container scanning method applied to the container scanning device 30.

[0145] The embodiment of the present application further provides a computer program product, which includes one or more computer instructions. When the computer instructions are loaded and executed on a computing device, the process or function described in the embodiment of the present application is generated in whole or in part.

[0146] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer or data center to another website, computer or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0147] When the computer program product is executed by a computer, the computer executes any of the aforementioned container scanning methods. The computer program product may be a software installation package, and when any of the aforementioned container scanning methods is required, the computer program product may be downloaded and executed on a computer.

[0148] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to each embodiment of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0149] The units involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the unit / module does not, in some cases, constitute a limitation on the unit itself.

[0150] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0151] In the context of the present application embodiment, machine-readable medium can be a tangible medium that can contain or store a program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable medium can include but is not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the above. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0152] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0153] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0154] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0155] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0156] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A container scanning method, characterized in that: Applied to a container scanner, the container scanner is deployed on a first host, and a target container is deployed on the first host. The method includes: Obtaining file handle information of the namespace of the target container, and creating a container scanning thread in the main process of the first host; According to the file handle information of the namespace of the target container, switching the container scanning thread to the namespace of the target container, so that the container scanning thread performs the container scanning task in the target container; A scanning result sent by the container scanning thread is received, and, according to the file handle information of the namespace of the target container, the container scanning thread is switched to the namespace of the main process.

2. The method according to claim 1, characterized in that The step of switching the container scanning thread to the namespace of the target container according to the file handle information of the namespace of the target container includes: Using the file handle information of the namespace of the target container as an input parameter, executing a system call for switching the namespace, and switching the container scanning thread to the namespace of the target container; The step of switching the container scanning thread to the namespace of the main process according to the file handle information of the namespace of the target container includes: The file handle information of the namespace of the target container is used as an input parameter, and the system call for switching the namespace is executed again to switch the container scanning thread to the namespace of the main process.

3. The method according to claim 1, characterized in that The obtaining the file handle information of the namespace of the target container includes: Obtaining process information running on the first host; Determine, according to the process link of the target container, the process information of the target container from the process information running on the first host; Scan a namespace directory corresponding to the process information of the target container to obtain file handle information of the namespace of the target container.

4. The method according to claim 3, characterized in that The determining, according to the process link of the target container, the process information of the target container from the process information running on the first host includes: Determine the process information of the process running on the first host that matches the pre-configured collection rule as the process information of the target container; wherein the collection rule is used to describe the process link of the target container.

5. The method according to claim 4, characterized in that The collection rule includes process information of the target container, process information of a parent container of the target container, and process information of a root container of the target container.

6. The method according to claim 3, characterized in that The scanning the namespace directory corresponding to the process information of the target container to obtain the file handle information of the namespace of the target container includes: Scan the namespace directory corresponding to the process information of the target container to determine the file path of the namespace of the target container; According to the file path of the namespace of the target container, in the namespace of the main process, open the file of the namespace of the target container, and obtain the file handle information of the namespace of the target container.

7. The method according to claim 1, characterized in that There is a shared memory between the namespace of the main process and the namespace of the target container; after switching the container scanning thread to the namespace of the target container, the method further includes: A scan command is sent to the container scan thread through the shared memory.

8. The method according to claim 1, characterized in that There is a shared memory between the namespace of the main process and the namespace of the target container; and receiving the scanning result sent by the container scanning thread includes: A scan result sent by the container scanning thread is received from the shared memory.

9. The method according to any one of claims 1 to 8, characterized in that: After switching the container scanning thread to the namespace of the main process according to the file handle information of the namespace of the target container, the method further includes: Switch the working directory of the container scanning thread to the working directory of the main process.

10. A container scanning device, characterized in that: The device is deployed on a container scanner, the container scanner is deployed on a first host, a target container is deployed on the first host, and the device includes: An acquisition module, used to acquire file handle information of the namespace of the target container; A creation module, used to create a container scanning thread in the main process of the first host; A switching module, configured to switch the container scanning thread to the namespace of the target container according to the file handle information of the namespace of the target container, so that the container scanning thread performs a container scanning task in the target container; A communication module, used to receive the scanning result sent by the container scanning thread; The switching module is further configured to switch the container scanning thread to the namespace of the main process according to the file handle information of the namespace of the target container.

11. An electronic device, characterized in that: The electronic device comprises a processor and a memory; The processor is configured to execute instructions stored in the memory, so that the electronic device performs the method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: The method comprises instructions, wherein the instructions instruct an electronic device to execute the method as claimed in any one of claims 1 to 9.

13. A computer program product, characterized in that The computer program product comprises computer readable instructions for implementing the method according to any one of claims 1 to 9.

Images