A container scanning method, apparatus, device, medium and product

Abstract

The application provides a container scanning method, device, equipment, medium and product, which are applied to a container scanner, the container scanner is deployed on a first host, the first host is deployed with a target container, and the method comprises the following steps: acquiring file handle information of a namespace of the target container, creating a container scanning thread in a main process of the first host; switching the container scanning thread to the namespace of the target container according to the file handle information of the namespace of the target container, so that the container scanning thread executes a container scanning task in the target container; receiving a scanning result sent by the container scanning thread, and switching the container scanning thread to the namespace of the main process according to the file handle information of the namespace of the target container. In the method, the complete file system of the target container can be covered, the integrity of the container scanning is realized, good compatibility is achieved for different container engines, and the container scanning is more flexible and efficient.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and particularly relates to a container scanning method and device, an electronic device, a computer readable storage medium and a computer program product. BACKGROUND

[0002] With the continuous development of computer technology, especially virtualization technology, containers emerge as the times require. Containers are a kind of lightweight and portable software running environment. By packaging an application program and its dependencies together, the application program can run in any environment supporting containers, so that the application program can maintain consistent running state in different running environments.

[0003] Comprehensive and accurate scanning of containers helps to ensure container security. Generally, the industry can use container management tools to scan containers. However, the above method cannot completely cover all files in the container, and there is a problem of container engine compatibility, and the completeness and compatibility of container scanning are poor. SUMMARY

[0004] The present application provides a container scanning method. The method can improve the completeness and compatibility of container scanning, making container scanning more flexible and efficient. The present application also provides a device, an electronic device, a computer readable storage medium and a computer program product corresponding to the above method.

[0005] In a first aspect, the present application provides a container scanning method applied to a container scanner, wherein the container scanner is deployed on a first host, and the first host is deployed with a target container. The method comprises the following steps:

[0006] obtaining file handle information of a namespace of the target container, and creating a container scanning thread in a main process of the first host;

[0007] switching the container scanning thread to the namespace of the target container according to the file handle information of the namespace of the target container, so that the container scanning thread executes a container scanning task in the target container;

[0008] receiving a scanning result sent by the container scanning thread, and switching the container scanning thread to a namespace of the main process according to the file handle information of the namespace of the target container.

[0009] In a second aspect, the present application provides a container scanning device, wherein the device is deployed on a container scanner, the container scanner is deployed on a first host, and the first host is deployed with a target container. The device comprises the following steps:

[0010] an obtaining module, configured to obtain file handle information of a namespace of the target container;

[0011] A creating module, configured to create a container scanning thread in a main process of the first host;

[0012] A switching module, configured to switch the container scanning thread to a namespace of the target container according to file handle information of the namespace of the target container, so that the container scanning thread performs a container scanning task in the target container;

[0013] A communication module, configured to receive a scanning result sent by the container scanning thread;

[0014] The switching module is further configured to switch the container scanning thread to the namespace of the main process according to the file handle information of the namespace of the target container.

[0015] In a third aspect, the present application provides an electronic device, which comprises a processor and a memory. The processor and the memory are in communication with each other. The processor is configured to execute instructions stored in the memory, so that the electronic device performs the container scanning method in the first aspect or any implementation manner of the first aspect.

[0016] In a fourth aspect, the present application provides a computer readable storage medium, which stores instructions. The instructions instruct an electronic device to perform the container scanning method in the first aspect or any implementation manner of the first aspect.

[0017] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on an electronic device, cause the electronic device to perform the container scanning method in the first aspect or any implementation manner of the first aspect.

[0018] On the basis of the implementation manners of the above aspects, the present application can be further combined to provide more implementation manners.

[0019] As can be seen from the above technical solutions, the present application has the following advantages:

[0020] The application provides a container scanning method, which is applied to a container scanner deployed on a first host, and the first host is deployed with a target container. The container scanner first acquires file handle information of a namespace of the target container, and in a main process of the first host, a container scanning thread is created, and the container scanner switches the container scanning thread to the namespace of the target container according to the file handle information of the namespace of the target container, so that the container scanning thread executes a container scanning task in the target container, then the container scanner receives a scanning result sent by the container scanning thread, and switches the container scanning thread to the namespace of the main process according to the file handle information of the namespace of the target container.

[0021] In the method, the direct interaction with the internal environment of the target container is realized by creating the container scanning thread in the main process of the host (i.e. the first host) and switching the container scanning thread to the namespace of the target container to be scanned. In this way, the container scanning task can be regarded as a task of scanning in the host, which can cover the complete file system of the target container and improve the completeness of the container scanning. Meanwhile, the thread switching is performed through the file handle information of the namespace of the target container, which does not depend on the interface provided by the container engine, has good compatibility for different container engines, and makes the container scanning more flexible and efficient. BRIEF DESCRIPTION OF DRAWINGS

[0022] In order to more clearly illustrate the technical method of the embodiments of the application, the drawings required to be used in the embodiments will be simply introduced as follows.

[0023] Figure 1 A schematic diagram of the architecture of a container scanner provided by the embodiments of the application is shown in the figure.

[0024] Figure 2 A schematic diagram of the flow of a container scanning method provided by the embodiments of the application is shown in the figure.

[0025] Figure 3 A schematic diagram of the structure of a container scanning device provided by the embodiments of the application is shown in the figure.

[0026] Figure 4 A schematic diagram of the structure of an electronic device provided by the embodiments of the application is shown in the figure. DETAILED DESCRIPTION

[0027] The terms "first", "second" in the embodiments of the application are only for the purpose of description, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features.

[0028] Firstly, some technical terms and application scenarios involved in the embodiments of the present application are introduced.

[0029] With the continuous development of computer technology, especially virtualization technology, containers emerge as the times require. Containers are a lightweight, portable software running environment. By packaging application programs and their dependencies together, containers can run in any environment that supports containers, thereby enabling application programs to maintain consistent running states in different running environments.

[0030] In a containerized environment, scanning for container vulnerabilities helps ensure container security. Container vulnerabilities can be understood as security vulnerabilities existing in containers. In related technologies, container scanning is usually performed using a container management tool. The container management tool can identify container assets and scan container data by using application programming interfaces (APIs) provided by a container engine during container construction and container deployment to identify security vulnerabilities existing in containers.

[0031] However, the above method has the following two defects: first, for data mounted in a special way, such as ConfigMap used to store configuration data or Secrets used to store critical data, since the above data is not directly reflected in the file system view of the container, it is difficult to cover the above configuration data or critical data when scanning the container by using the container management tool, and the completeness of the container scanning is poor.

[0032] In addition, with the diversification of container technology, containers provided by different container engines may have different file system organization structures, and scanning containers by using a container management tool depends on the API capabilities provided by the container engine. Therefore, the container management tool usually only supports use in a specific container engine, and has poor compatibility and applicability.

[0033] Therefore, the present application provides a container scanning method. The method is applied to a container scanner deployed on a first host, and the first host deploys a target container. The container scanner first obtains file handle information of a namespace of the target container, and creates a container scanning thread in a main process of the first host. The container scanner switches the container scanning thread to the namespace of the target container according to the file handle information of the namespace of the target container, so that the container scanning thread performs a container scanning task in the target container. Then, the container scanner receives a scanning result sent by the container scanning thread, and switches the container scanning thread to the namespace of the main process according to the file handle information of the namespace of the target container.

[0034] In the method, the direct interaction with the internal environment of the target container is achieved by creating a container scanning thread in the main process of the host computer (i.e., the first host computer) and switching the container scanning thread into the namespace of the target container to be scanned. In this way, the container scanning task can be regarded as a task of scanning inside the host computer, which can cover the complete file system of the target container and achieve the completeness of the container scanning. Meanwhile, the thread switching is performed through the file handle information of the namespace of the target container, which does not depend on the interface provided by the container engine and has good compatibility for different container engines, so that the container scanning is more flexible and efficient.

[0035] In order to facilitate the understanding of the technical solutions provided by the embodiments of the present application, the following will be described with reference to the accompanying drawings.

[0036] Referring to Figure 1 The architecture of the container scanner provided by the embodiments of the present application is shown in the figure. The container scanner is deployed in the first host computer 10, and the first host computer 10 also deploys at least one container, including a target container. The first host computer 10, which can also be referred to as a host computer, can be understood as a physical computer or a virtual machine (VM) that runs at least one container. In other words, the first host computer 10 provides necessary hardware resources for the at least one container, such as a central processing unit (CPU), memory, storage interface, network interface, etc. The at least one container is isolated from each other on the first host computer 10, shares the kernel of the first host computer 10, and respectively runs respective application programs and dependent environments.

[0037] In the embodiments of the present application, the container scanner runs in the namespace 11, and the target container runs in the namespace 12. The namespace (namespace) is used to realize the isolation and resource management of the containers running in the first host computer 10. By allocating different namespaces to different containers, the resource isolation and limitation between different containers and between the container and the first host computer 10 are ensured, an independent running environment is provided for different containers, the processes and resources in the container are isolated from the outside world, and the overall security and stability are improved. Specifically, the namespace can include multiple types of namespaces, and different types of namespaces are used to isolate different resources, for example, a network namespace (network namespace) is used to isolate network resources, and a mount namespace (mount namespace) is used to isolate a file system.

[0038] In other words, the namespace 11 can be understood as a namespace used by the first host computer 10, i.e., the namespace 11 is the namespace in which the main process of the first host computer 10 is located. The container scanner runs in the main process 111 of the first host computer 10, and the namespace 12 is a namespace different from the namespace 11.

[0039] In the embodiment of the present application, the container scanner obtains the file handle information of the namespace 12 of the target container, and in the main process 111 of the first host, a container scanning thread 112 is created, which can be used to execute the container scanning task. Then, the container scanner switches the container scanning thread 112 from the namespace 11 of the container scanner to the namespace 12 of the target container according to the file handle information of the namespace 12 of the target container.

[0040] By injecting the container scanning thread 112 into the namespace 12 of the target container, the container scanning thread 112 executes the container scanning task in the target container, which is equivalent to scanning in the host. Without calling the API provided by the container engine, the file system 121 of the target container can be accessed, and the file data in the file system 121 can be scanned.

[0041] In addition, in the embodiment of the present application, the namespace 11 of the container scanner and the namespace 12 of the target container can have a shared memory 13. The container scanner can send a scanning command to the container scanning thread 112 running in the namespace 12 of the target container through the shared memory 13. When the container scanning thread 112 completes the scanning task, it can also send the scanning result to the container scanner through the shared memory 13. The container scanner can also switch the container scanning process 112 back to the namespace 11 of the container scanner to complete the scanning of the target container.

[0042] In this way, by injecting the container scanning process into the namespace of the target container, the container scanning process can directly access the file data in the target container, shielding the differences in the upper container form and the container engine, and improving the adaptability and compatibility of the container scanning.

[0043] Based on the architecture diagram of the container scanner provided in the foregoing, the embodiment of the present application further provides a container scanning method. Referring to Figure 2 The embodiment of the present application provides a flow diagram of a container scanning method, which can be applied to a container scanner deployed in a first host, and the first host also deploys a target container. The method specifically includes the following steps:

[0044] S201: Obtain the file handle information of the namespace of the target container, and in the main process of the first host, create a container scanning thread.

[0045] The target container can be understood as a container that needs to be scanned. In the embodiment of the present application, at least one container can be deployed in the first host, and the target container can be any container running in the at least one container in the first host.

[0046] File handle information (file handle) can be understood as an object for identifying and referencing a file. In some embodiments, the file handle information can include one or more of a file descriptor, a file pointer, file state information, file attributes, and a file type. Generally, when a file is opened, file handle information for the file can be created. In this way, by creating file handle information, it is indicated that an instance of the file is opened.

[0047] In the embodiments of the present application, since the switching of the container scanning thread in different namespaces is involved, the file handle information of the namespace of the target container needs to be obtained to ensure that the container scanning thread can be smoothly switched between the namespace of the target container and the namespace of the main process, and the stability and reliability in the actual application process are guaranteed.

[0048] The specific process of obtaining the file handle information by the container scanner will be described below. In some possible implementation ways, in order to shield the differences between different container engines and solve the problem of difficulty in locating the target container under different container engines, the container can be regarded as a process, and the file handle information can be obtained by collecting the process.

[0049] Specifically, the container scanner can obtain process information of the first host, determine process information of the target container from the process information of the first host according to a process link of the target container, and then scan a namespace directory corresponding to the process information of the target container to obtain the file handle information of the namespace of the target container.

[0050] The process information of the first host can be used to represent information related to the process running on the first host, for example, the process information can include process name, process identity, process running information, etc. In some possible implementation ways, first, the virtual file system of the first host is traversed, for example, the / proc file system is traversed, and the / proc directory is accessed, where each subdirectory in the / proc directory represents a process, and the subdirectory name is the process identity (process identity, PID). Then, the cmdline file in each subdirectory is read to obtain the process information of the first host.

[0051] Since the container is regarded as a process in the embodiments of the present application, the nesting relationship between the multiple containers running on the first host can be regarded as a process link. The process information matched with the process link of the target container is filtered from the process information of the first host, and then the process information of the target container is determined to locate the target container.

[0052] In a specific implementation, the container scanner can determine, as the process information of the target container, the process information in the process information of the first host that matches the preconfigured collection rule.

[0053] The collection rule is used to describe the process link of the target container. That is, in the embodiments of the present application, the corresponding collection rule is configured for the process link of at least one container running on the first host, forming a collection rule set. In this way, when there is a need to scan the target container, the collection rule corresponding to the target container is determined from the collection rule set, and the process information of the first host is matched with the collection rule corresponding to the target container. The process information that matches successfully is determined as the process information of the target container.

[0054] In the embodiments of the present application, by analyzing the process information on the first host and combining the collection rule, the running container instance is identified, and on the basis of not relying on the API provided by the container engine or the specific container management tool, the container asset is identified, solving the compatibility problem of adapting to the container engine, and realizing efficient compatibility identification of the container asset.

[0055] In some possible implementations, the collection rule can include process information of the target container, process information of a parent container of the target container, and process information of a root container of the target container. The root container can be understood as a container instance directly started from a container image, that is, a container serving as a starting point of a container hierarchical structure. The parent container can be understood as a container having a parent-child container relationship with the target container, that is, the target container running inside the parent container.

[0056] In some embodiments, the process information of the target container can be the process name of the target container, the process information of the parent container of the target container can be the process name of the parent container of the target container, and the process information of the root container of the target container can be the process name of the root container of the target container. In this case, the collection rule can have the following form:

[0057] root_process_name: root container process name

[0058] parent_process_name: parent container process name

[0059] target_process_name: target container process name

[0060] When performing collection rule matching, the process name of the root container of the target container can be matched first, then any number of unspecified characters (for example, other process names) are matched, then the process name of the parent container of the target container is matched, again any number of unspecified characters are matched, and finally the process name of the target container is matched.

[0061] In other words, the process of matching the process information running on the first host with the collection rules can be represented by the following regular expression: $(root_process_name).*?$(parent_process_name).*?$(target_process_name). Here, target_process_name represents the process name of the target container, parent_process_name represents the process name of the parent container of the target container, and root_process_name represents the process name of the root container of the target container. By matching the process information running on the first host with the regular expression, process information whose process chains match the regular expression is identified as the process information of the target container, thus achieving target container identification.

[0062] After identifying the target container, the container scanner can further obtain the file handle information of the target container's namespace based on the target container's process information. Specifically, the container scanner can scan the namespace directory corresponding to the target container's process information to determine the file path of the target container's namespace. Then, based on the file path of the target container's namespace, it can open the file in the target container's namespace within the main process's namespace and obtain the file handle information of the target container's namespace.

[0063] In this context, the namespace directory corresponding to the process information of the target container can be understood as the directory corresponding to the PID of the target container, and the file path can be understood as a string representing the location of a file, used to locate and access resources in the file system. In some embodiments, the files in the target container's namespace may include files in the mounted namespace (mnt fd file) and files in the network namespace (net fd file), and the file path of the target container's namespace may include the file path of the mnt fd file and the file path of the net fd file.

[0064] The main process of the first host can be understood as the first user-level process initialized when the operating system of the first host starts. By opening a file in the target container's namespace within the main process's namespace and keeping that file open, the file handle information of the target container's namespace can be stored in the memory of the main process's namespace. The container scanner can then obtain this file handle information.

[0065] For example, in the namespace of the main process, the mnt fd file is opened through / proc / {pid} / ns / mnt, the net fd file is opened through / proc / {pid} / ns / net, and the opening of the mnt fd file and the net fd file is maintained, so that the container scanner obtains the file handle information of the namespace of the target container.

[0066] In combination with the specific examples, in some examples, the execution code of the container scanner obtaining the file handle information of the namespace of the target container is as follows:

[0067] [root@id ~]# ps -ef | grep super

[0068] root 11106 11105 0 Sep05 pts / 2 00:00:05. / supervisord

[0069] [root@id 11106]# cd / proc / 11106 / ns

[0070] [root@id ns]# ll

[0071] total 0

[0072] lrwxrwxrwx 1 root root 0 Sep 11 16:54 ipc -> ipc:[4026532452]

[0073] lrwxrwxrwx 1 root root 0 Sep 5 20:53 mnt -> mnt:[4026532450]

[0074] lrwxrwxrwx 1 root root 0 Sep 9 15:24 net -> net:[4026532455]

[0075] lrwxrwxrwx 1 root root 0 Sep 11 16:54 pid -> pid:[4026532453]

[0076] lrwxrwxrwx 1 root root 0 Sep 18 20:32 user -> user:[4026531837]

[0077] lrwxrwxrwx 1 root root 0 Sep 11 16:54 uts -> uts:[4026532451]

[0078] Wherein, the PID of the target container is 11106, the container scanner can scan the directory / proc / 11106 / ns, record the file path of the mnt fd file and the file path of the net fd file. Then, according to the file path of the mnt fd file and the file path of the net fd file, open the mnt fd file and the net fd file, and obtain the file handle information of the namespace of the target container.

[0079] In addition, the container scanner can also create a container scanning thread. Wherein, the container scanning thread can be understood as a thread used to execute a container scanning task. In the embodiment of the present application, according to the scanning requirement of the target container, the container scanner creates a container scanning thread in the main process of the first host, that is, creates a container scanning thread in the namespace of the main process.

[0080] S202: According to the file handle information of the namespace of the target container, switch the container scanning thread to the namespace of the target container, so that the container scanning thread executes the container scanning task in the target container.

[0081] In the embodiment of the present application, according to the file handle information of the namespace of the target container, the container scanning thread created in the namespace of the main process is injected into the namespace of the target container, so that the container scanning thread can run in the namespace of the target container.

[0082] When implemented, considering that the container scanner needs to switch the namespace of the container scanning thread, the main thread of the container scanner can be locked, for example, the main thread of the container scanner is locked through runtime.LockOSThread(), to ensure that the container scanning thread can normally switch the namespace and will not be scheduled by other coroutines.

[0083] Further, before performing the namespace switching of the container scanning thread, an unshare operation also needs to be performed to ensure the successful switching of the namespace. Wherein, the unshare operation can create a new independent environment for the calling thread without affecting other threads, so that the calling thread can perform operations in the isolated environment. That is, after creating the container scanning thread in the namespace of the main process, performing the unshare operation, creating a new namespace for the container scanning thread, and then switching the container scanning thread from the new namespace to the namespace of the target container. Considering that threads usually share mount points (mnt) and other information, therefore, in some embodiments, the unshare operation can be performed only for mnt, that is, only a new mount namespace is created for the container scanning thread.

[0084] Then, the file handle information of the namespace of the target container is taken as an input parameter, a system call for switching the namespace is executed, and the container scanning thread is switched to the namespace of the target container.

[0085] That is, the namespace switching operation of the container scanning thread can be implemented through a system call for switching the namespace. The system call for switching the namespace can be a setns operation, which is a system call operation for adding a thread to an existing namespace. Since the file handle information of the namespace of the target container has been obtained, the namespace of the target container already exists. By executing the setns operation with the file handle information of the namespace of the target container as an input parameter, the container scanning thread can change the current namespace and enter the namespace of the other process (i.e., the target container) to share the same resource view with the switched process.

[0086] In some possible implementation manners, the namespace of the main process can share memory with the namespace of the target container, that is, the namespace of the main process can exist in shared memory with the namespace of the target container. In this case, the container scanner can send a scanning command to the container scanning thread through the shared memory.

[0087] The scanning command can be a command for instructing the container scanning thread to execute different types of scanning logic in the target container, such as a cat, ls, find, or other scanning command. In this way, the scanning command is delivered through the shared memory to implement scanning on the target container.

[0088] By switching the container scanning thread, the container scanning thread is injected into the namespace of the target container to directly interact with the internal environment of the target container, so that the container scanning thread can directly access the complete file system in the target container, including temporary files generated at runtime, hidden files, and files with special permissions, to achieve comprehensive coverage of container scanning and enhance the flexibility and application range of container scanning. At the same time, the container scanning thread is decoupled from the underlying container engine to achieve compatibility coverage of different types of container engines.

[0089] S203: receiving the scanning result sent by the container scanning thread, and switching the container scanning thread to the namespace of the main process according to the file handle information of the namespace of the target container.

[0090] The scanning result can be understood as data collected after scanning the target container. For example, the scanning result can include vulnerability data of the target container, configuration file data of the target container, and the like.

[0091] In some possible implementations, the namespace of the main process can have shared memory with the namespace of the target container, in which case the container scanner can receive the scanning result sent by the container scanning thread from the shared memory.

[0092] That is, the container scanning thread can return the data collected after scanning the target container to the namespace of the main process through shared memory, reducing the complexity of cross-namespace communication, while ensuring the efficiency and security of data transmission.

[0093] Further, since the files (for example, mnt fd files and net fd files) of the namespace of the target container are opened in the namespace of the main process, the container scanner can obtain the file handle information of the namespace of the target container in the memory of the namespace of the main process. In this way, by retaining the file handle information of the namespace of the target container, the file handle information of the namespace of the target container is used as an input parameter to execute the system call (i.e., setns operation) for switching the namespace again, so as to switch the container scanning thread to the namespace of the main process. Further, after the container scanning thread completes the scanning task, the container scanning thread is switched back to the namespace of the main process, so as to implement one-time container scanning.

[0094] In combination with specific examples, in some examples, the execution code of the container scanner for switching the namespace is as follows:

[0095] MainTid := strconv.Itoa(unix.Gettid())

[0096] netFS, err := os.Open(fmt.Sprintf(" / proc / %s / ns / net", MainTid)

[0097] mntFS, err := os.Open(fmt.Sprintf(" / proc / %s / ns / mnt", MainTid) ...

[0099] netfs,_ := os.Open(" / proc / %s / ns / mnt", 11106)

[0100] mntfs,_ := os.Open(" / proc / %s / ns / net", 11106)

[0101] syscall.Unshare(syscall.CLONE_NEWNS)

[0102] unix.Setns(netfs.Fd(), syscall.CLONE_NEWNS)

[0103] unix.Setns(mntfs.Fd(), syscall.CLONE_NEWNET)

[0104] Wherein, the PID of the target container is 11106, syscall.Unshare(syscall.CLONE_NEWNS) is used to perform the unshare operation, unix.Setns(netfs.Fd(), syscall.CLONE_NEWNS) is used to switch the container scanning thread to the namespace of the target container, and unix.Setns(mntfs.Fd(), syscall.CLONE_NEWNET) is used to switch the container scanning thread back to the namespace of the main process.

[0105] Further, after the container scanner switches the container scanning thread to the namespace of the main process according to the file handle information of the namespace of the target container, the working directory of the container scanning thread can also be switched to the working directory of the main process.

[0106] In the embodiment of the present application, considering that after performing the switching of the container scanning thread back to the namespace of the main process, the working directory of the container scanning thread will usually be defaulted to the root directory, therefore, the working directory is switched together, for example, the working directory is switched through os.Chdir(originWorkDir), so as to avoid affecting the normal work of the container scanner.

[0107] In the method, the container scanning thread is created in the main process of the host (i.e., the first host), and the container scanning thread is switched to the namespace of the target container to be scanned, so as to realize the direct interaction with the internal environment of the target container. In this way, the container scanning task can be regarded as a task of scanning in the host, which can cover the complete file system of the target container, and realize the completeness of the container scanning. At the same time, the thread is switched through the file handle information of the namespace of the target container, which does not depend on the interface provided by the container engine, has good compatibility for different container engines, and makes the container scanning more flexible and efficient.

[0108] Moreover, the container scanning method provided by the embodiment of the present application can be applied to the field of scanning of container images, and by integrating and summarizing the scanning results obtained by the container scanning, the purpose of scanning the container images can be achieved.

[0109] The above is combined with Figure 1 and Figure 2The container scanning method provided by the embodiments of the present application is described in detail, and the device and the equipment provided by the embodiments of the present application will be introduced below with reference to the drawings.

[0110] Referring to Figure 3 The structure diagram of the container scanning device is shown in the figure, and the device 30 comprises:

[0111] The obtaining module 301 is configured to obtain file handle information of a namespace of the target container.

[0112] The creating module 302 is configured to create a container scanning thread in a main process of the first host.

[0113] The switching module 303 is configured to switch the container scanning thread to the namespace of the target container according to the file handle information of the namespace of the target container, so that the container scanning thread performs a container scanning task in the target container.

[0114] The communication module 304 is configured to receive a scanning result sent by the container scanning thread.

[0115] The switching module 303 is further configured to switch the container scanning thread to the namespace of the main process according to the file handle information of the namespace of the target container.

[0116] In some possible implementation manners, the switching module 303 is specifically configured to:

[0117] take the file handle information of the namespace of the target container as an input parameter, execute a system call for switching a namespace, and switch the container scanning thread to the namespace of the target container; or

[0118] take the file handle information of the namespace of the target container as an input parameter, execute the system call for switching the namespace again, and switch the container scanning thread to the namespace of the main process.

[0119] In some possible implementation manners, the obtaining module 301 is specifically configured to:

[0120] obtain process information of the first host;

[0121] determine process information of the target container from the process information of the first host according to a process link of the target container;

[0122] scan a namespace directory corresponding to the process information of the target container, and obtain the file handle information of the namespace of the target container.

[0123] In some possible implementation manners, the obtaining module 301 is specifically configured to:

[0124] The process information in the process information of the first host that matches the preconfigured collection rule is determined as the process information of the target container; the collection rule is used to describe the process link of the target container.

[0125] In some possible implementation manners, the collection rule includes the process information of the target container, the process information of the parent container of the target container, and the process information of the root container of the target container.

[0126] In some possible implementation manners, the obtaining module 301 is specifically configured to:

[0127] The namespace directory corresponding to the process information of the target container is scanned to determine the file path of the namespace of the target container;

[0128] According to the file path of the namespace of the target container, a file of the namespace of the target container is opened in the namespace of the main process to obtain file handle information of the namespace of the target container.

[0129] In some possible implementation manners, the namespace of the main process and the namespace of the target container have shared memory; the communication module 304 is further configured to:

[0130] The scanning command is sent to the container scanning thread through the shared memory.

[0131] In some possible implementation manners, the namespace of the main process and the namespace of the target container have shared memory; the communication module 304 is specifically configured to:

[0132] The scanning result sent by the container scanning thread is received from the shared memory.

[0133] In some possible implementation manners, the switching module 303 is further configured to:

[0134] The working directory of the container scanning thread is switched to the working directory of the main process.

[0135] The container scanning apparatus 30 according to the embodiments of the present application can correspond to performing the methods described in the embodiments of the present application, and the above and other operations and / or functions of each module / unit of the container scanning apparatus 30 are respectively implemented to realize the corresponding flow of each method in the embodiments of the present application. For brevity, they will not be described here again. Figure 2 The above and other operations and / or functions of each module / unit of the container scanning apparatus 30 are respectively implemented to realize the corresponding flow of each method in the embodiments of the present application. For brevity, they will not be described here again.

[0136] The embodiments of the present application also provide an electronic device. The electronic device is specifically used to implement the functions of the container scanning device 30 in the embodiments shown in the drawings. Figure 3

[0137] Figure 4 A structural schematic diagram of an electronic device 400 is provided, as shown in the drawings. Figure 4 The electronic device 400 includes a bus 401, a processor 402, a communication interface 403 and a memory 404. The processor 402, the memory 404 and the communication interface 403 communicate through the bus 401.

[0138] The bus 401 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 only one thick line is used in the drawings, but it does not mean that there is only one bus or only one type of bus.

[0139] The processor 402 can be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP) processor.

[0140] The communication interface 403 is used for external communication. For example, the communication interface 403 can be used for communication with a terminal.

[0141] The memory 404 can include a volatile memory, such as a random access memory (RAM). The memory 404 can also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0142] The memory 404 stores executable code, and the processor 402 executes the executable code to perform the foregoing container scanning method.

[0143] Specifically, in the implementation Figure 3 ​In the case of the illustrated embodiment, and Figure 3 In the case that the modules or units of the container scanning apparatus 30 described in the embodiments are implemented by software, the software or program codes required for performing the functions of the modules / units in the container scanning method can be stored in the memory 404 in part or in whole. The processor 402 executes the program codes corresponding to the units stored in the memory 404 to perform the container scanning method described above. Figure 3 In the case that the modules or units of the container scanning apparatus 30 described in the embodiments are implemented by software, the software or program codes required for performing the functions of the modules / units in the container scanning method can be stored in the memory 404 in part or in whole. The processor 402 executes the program codes corresponding to the units stored in the memory 404 to perform the container scanning method described above.

[0144] The embodiments of the present application also provide a computer readable storage medium. The computer readable storage medium can be any available medium or data storage device that can store the instructions of the computer device. The available medium can be a magnetic medium (e.g., floppy diskette, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk), etc. The computer readable storage medium includes instructions indicating the computer device to perform the container scanning method applied to the container scanning apparatus 30 described above.

[0145] The embodiments of the present application also provide a computer program product including one or more computer instructions. When the computer instructions are loaded and executed on the computer device, the flow or function described in the embodiments of the present application is generated in whole or in part.

[0146] The computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be transferred from one website, computer or data center to another website, computer or data center through wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode.

[0147] The computer program product is executed by a computer, and the computer executes any of the container scanning methods described above. The computer program product can be a software installation package, and when any of the container scanning methods described above is needed, the computer program product can be downloaded and executed on the computer.

[0148] The computer program product of the first aspect can include a computer readable storage medium. The computer readable storage medium can include instructions. The instructions can include one or both of: instructions for causing a computer to implement a method as described above; and instructions for causing a computer to operate based on a design described above.

[0149] The units described in the embodiments of the present application can be implemented by software, or by hardware. In some cases, the name of the unit / module does not constitute a limitation on the unit itself.

[0150] The functions described above in the specification can be performed by one or more hardware logic components. For example, and without limitation, illustrative types of hardware logic components that can be used include: Field-programmable Gate Arrays (FPGAs), Program-specific Integrated Circuits (ASICs), Program-specific Standard Products (ASSPs), System-on-a-chip systems (SOCs), Complex Programmable Logic Devices (CPLDs), etc.

[0151] In the context of the embodiments of the present application, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium will include one or more of: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0152] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems or apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and relevant parts can be referred to the method section.

[0153] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0154] It should also be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0155] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0156] The foregoing description of the disclosed embodiments enables a person skilled in the art to make or use the application. Modifications of these embodiments will occur to persons of skill in the art, and that the generic principles defined herein can be applied to other embodiments without departing from the spirit or scope of the application. Therefore, the present application is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A container scanning method, characterized in that, The method, applied to a container scanner deployed on a first host where a target container is deployed, includes: Obtain file handle information of the namespace of the target container, and create a container scanning thread in the main process of the first host, wherein the namespace of the main process and the namespace of the target container share memory; Based on the file handle information of the target container's namespace, the container scanning thread is switched to the target container's namespace, so that the container scanning thread enters the target container's namespace and performs a container scanning task in the target container; wherein, the container scanning task is used to scan file data in the target container's file system; Send scan commands to the container scanning thread via the shared memory; The process receives scan results from the container scanning thread from the shared memory, and switches the container scanning thread to the namespace of the main process based on the file handle information of the target container's namespace. The scan results are data collected by the container scanning thread after scanning the target container.

2. The method according to claim 1, characterized in that, The step of switching the container scanning thread to the namespace of the target container based on the file handle information of the target container's namespace includes: The system call for switching namespaces is executed by taking the file handle information of the target container's namespace as input parameters, and the container scanning thread is switched to the namespace of the target container. The step of switching the container scanning thread to the namespace of the main process based on the file handle information of the target container's namespace includes: Using the file handle information of the target container's namespace as input parameters, the system call for switching namespaces is executed again to switch the container scanning thread to the namespace of the main process.

3. The method according to claim 1, characterized in that, The step of obtaining the file handle information of the namespace of the target container includes: Obtain process information running on the first host; Based on the process chain of the target container, the process information of the target container is determined from the process information running on the first host; Scan the namespace directory corresponding to the process information of the target container to obtain the file handle information of the namespace of the target container.

4. The method according to claim 3, characterized in that, The step of determining the process information of the target container from the process information running on the first host based on the process chain of the target container includes: The process information that matches the pre-configured collection rules in the process information running on the first host is determined as the process information of the target container; wherein, the collection rules are used to describe the process chain of the target container.

5. The method according to claim 4, characterized in that, The collection rules include the process information of the target container, the process information of the target container's parent container, and the process information of the target container's root container.

6. The method according to claim 3, characterized in that, The step of scanning the namespace directory corresponding to the process information of the target container and obtaining the file handle information of the target container's namespace includes: Scan the namespace directory corresponding to the process information of the target container to determine the file path of the namespace of the target container; Based on the file path of the target container's namespace, open the file in the target container's namespace within the main process's namespace and obtain the file handle information of the target container's namespace.

7. The method according to any one of claims 1 to 6, characterized in that, After switching the container scanning thread to the namespace of the main process based on the file handle information of the target container's namespace, the method further includes: Switch the working directory of the container scanning thread to the working directory of the main process.

8. A container scanning device, characterized in that, The device is deployed on a container scanner, the container scanner is deployed on a first host, and the first host has a target container deployed thereon. The device includes: The acquisition module is used to acquire file handle information of the namespace of the target container; A module is created to create a container scanning thread in the main process of the first host, wherein the namespace of the main process and the namespace of the target container share memory; The switching module is used to switch the container scanning thread to the namespace of the target container based on the file handle information of the namespace of the target container, so that the container scanning thread enters the namespace of the target container and performs a container scanning task in the target container; wherein, the container scanning task is used to scan the file data in the file system of the target container; A communication module is used to send scan commands to the container scanning thread via the shared memory; The communication module is also used to receive scan results sent by the container scanning thread from the shared memory; The switching module is further configured to switch the container scanning thread to the namespace of the main process based on the file handle information of the target container's namespace, wherein the scanning result is the data collected by the container scanning thread after scanning the target container.

9. An electronic device, characterized in that, The electronic device includes a processor and a memory; The processor is configured to execute instructions stored in the memory, causing the electronic device to perform the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Includes instructions that instruct an electronic device to perform the method as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, The computer program product includes computer-readable instructions for implementing the method according to any one of claims 1 to 7.

Images