Method, system and related device for constructing application mirror image

Abstract

The invention discloses a method, a system and a related device for constructing an application mirror image, which are used for improving the efficiency of repairing vulnerabilities, shortening the window period of repairing the vulnerabilities and effectively improving the safety and the stability. The method comprises the following steps: when a code submission request of a warehouse management system is monitored, obtaining a repair version number of a basic mirror image; detecting whether a basic mirror image version in the Docker file is updated or not according to the repair version number; if it is determined that the Dockerfile is not updated, the Dockerfile is modified according to the repair version number; and constructing an application mirror image according to the modified Dockerfile file.

Description

Technical Field

[0001] The present application relates to the field of native application security technology, and in particular to a method, device and storage medium for building an application image. Background Art

[0002] With the widespread application of cloud-native technologies such as cloud computing, container technology, and microservice architecture, enterprise application architecture is undergoing profound changes. Cloud-native applications, with their advantages such as flexibility, scalability, and agility, have brought unprecedented development opportunities to enterprises. At the same time, ensuring the security of images in cloud-native applications has become an indispensable part of enterprise security strategies. If there are security vulnerabilities in the image, if they are not repaired in time, it may lead to serious consequences.

[0003] In the existing technology, fixing image vulnerabilities usually requires manual intervention. Developers need to analyze vulnerability reports, determine which vulnerabilities affect their applications, and then manually modify the Dockerfile file that is relied on when building the application image. After completing the modification of the Dockerfile, developers also need to re-run the build script to generate a new application image.

[0004] However, when there are many applications, developers need to check and modify the Dockerfile of each application one by one, and then rebuild and deploy each application image. This repetitive work is inefficient and cannot be repaired quickly and accurately, causing the application to be exposed to risks before the vulnerability is fixed, posing a huge security risk. Summary of the invention

[0005] In order to solve the above technical problems, the present application provides a method, system and related devices for building an application image.

[0006] The technical solution provided in this application is described below:

[0007] The first aspect of the present application provides a method for building an application image, which is applied to a continuous integration and continuous deployment system, including:

[0008] When a code submission request is received from the warehouse management system, the repair version number of the base image is obtained;

[0009] Detect whether the base image version in the Dockerfile file is updated according to the repair version number;

[0010] If it is determined that it is not updated, modify the Dockerfile file according to the repair version number;

[0011] Build the application image according to the modified Dockerfile file.

[0012] Optionally, after building the application image according to the modified Dockerfile file, the method further includes:

[0013] Pushing the application image to the image warehouse;

[0014] According to the address of the application image in the image repository, containerized deployment of the system microservice application is performed.

[0015] Optionally, the containerized deployment of the system microservice application according to the address of the application image in the image repository includes:

[0016] Modify the image address of the resource file in the container management platform according to the address of the application image in the image warehouse;

[0017] The workload is started through the container management platform for containerized deployment.

[0018] Optionally, when a code submission request of the warehouse management system is monitored, obtaining the repair version number of the base image includes:

[0019] When a code submission request from the warehouse management system is monitored, an application image to be built is determined according to the code submission request;

[0020] Determine a base image specified by the application image to be built, and obtain an identifier of the base image;

[0021] According to the identifier of the base image, a repair version number of the base image is obtained through a target system, and the target system is used to detect and repair vulnerabilities of the base image.

[0022] Optionally, obtaining the repair version number of the base image through the target system according to the identifier of the base image includes:

[0023] Sending a version query request to the target system according to the identifier of the base image, so that the target system queries the latest repair version number of the base image;

[0024] Receive the repair version number returned by the target system.

[0025] Optionally, modifying the Dockerfile file according to the repair version number includes:

[0026] Modify the base image version number specified in the from field in the Dockerfile file according to the repair version number.

[0027] Optionally, detecting whether the base image version in the Dockerfile file is updated according to the repair version number includes:

[0028] Use a script file to detect whether the base image version in the Dockerfile is consistent with the repair version number;

[0029] If they are inconsistent, it is determined that the base image version in the Dockerfile file has not been updated.

[0030] A second aspect of the present application provides a system for building an application image, the system comprising:

[0031] An acquisition unit, used to acquire the repair version number of the base image when a code submission request of the warehouse management system is monitored;

[0032] A detection unit, used to detect whether the basic image version in the Dockerfile file is updated according to the repair version number;

[0033] A modification unit, configured to modify the Dockerfile file according to the repair version number when the detection unit determines that the file is not updated;

[0034] The build unit is used to build the application image according to the modified Dockerfile file.

[0035] A third aspect of the present application provides a device for building an application image, the device comprising:

[0036] Processor, memory, input-output unit, and bus;

[0037] The processor is connected to the memory, the input and output unit, and the bus;

[0038] The memory stores a program, and the processor calls the program to execute the first aspect and any optional method in the first aspect.

[0039] A fourth aspect of the present application provides a computer-readable storage medium, on which a program is stored. When the program is executed on a computer, the program executes the first aspect and any optional method in the first aspect.

[0040] It can be seen from the above technical solutions that this application has the following advantages:

[0041] By listening to code submission requests, the repair version number of the base image is automatically obtained, and the base image version in the Dockerfile file is detected to be updated. When it is determined that the base image version in the Dockerfile file has not been updated, the base image version number in the Dockerfile file is automatically modified to the repair version number, and the application image is built based on the modified Dockerfile file to ensure that the base image used to build the application image is the latest security version. The entire process does not require manual intervention, which significantly improves the efficiency of vulnerability repair, reduces the risk of configuration errors, and greatly shortens the window period for vulnerability repair, effectively improving security and stability. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solution in the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0043] Figure 1 A flowchart of an embodiment of a method for building an application image provided by the present application;

[0044] Figure 2 A flowchart of another embodiment of the method for building an application image provided by the present application;

[0045] Figure 3 A schematic diagram of an embodiment of the process of containerized deployment of system microservice applications in the method for building an application image provided by the present application;

[0046] Figure 4 A schematic diagram of an embodiment of the process of obtaining an image version in the method for building an application image provided by the present application;

[0047] Figure 5 A schematic diagram of the structure of an embodiment of a system for building an application image provided by the present application;

[0048] Figure 6 A schematic diagram of the structure of an embodiment of the device for building an application image provided by the present application. DETAILED DESCRIPTION

[0049] The present application provides a method for building an application image, which can improve the efficiency of repairing vulnerabilities, shorten the window period for repairing vulnerabilities, and effectively improve security and stability. It should be noted that the method for building an application image in the present application is applied to a continuous integration and continuous deployment system, namely a CI / CD system.

[0050] The CI / CD system is a modern software development practice that improves the efficiency and quality of software development and deployment through automated and continuous processes. Continuous integration (CI) integrates code into a shared repository, and each integration triggers an automated build and test process to discover and solve problems as early as possible; continuous deployment (CD) ensures that code that has passed automated testing and verification can be deployed to the production environment at any time. Automated testing covers multiple levels such as unit testing, integration testing, and end-to-end testing to ensure that each code change can pass rigorous verification. The CI / CD system reduces the risk of manual operations and improves code quality and deployment efficiency by automating the build, test, and deployment processes.

[0051] See also Figure 1 The present application first provides an embodiment of a method for building an application image, the embodiment comprising:

[0052] S101. When a code submission request of the warehouse management system is monitored, a repair version number of the base image is obtained;

[0053] In this embodiment, the continuous integration and continuous deployment system first listens to the code submission request of the warehouse management system. The continuous integration and continuous deployment system is integrated with the warehouse management system. After the integration is successful, the continuous integration and continuous deployment system will set a listener to monitor the code submission events of the warehouse management system in real time. Once the listener detects the code submission event, the continuous integration and continuous deployment system will immediately trigger the corresponding processing flow, which includes the compilation and packaging operations of the code. Among them, the compilation operation will convert the code file submitted by the developer into an executable binary file or library file to ensure the correctness and compatibility of the code. The packaging operation will package the compiled product into a deployable format, usually in the format of a Docker image, JAR package or WAR package, for subsequent deployment.

[0054] In the automated build process, the continuous integration and continuous deployment system uses the base image as the starting point for building new application images. Therefore, when the continuous integration and continuous deployment system listens to the code submission request from the warehouse management system, it also needs to obtain the repair version number of the base image. The repair version number represents the latest status of the base image, which may include security patches, updates to dependent libraries, updates to the operating system, etc. Each time the base image is updated, the version number will change accordingly. By obtaining the latest repair version number of the base image, it can ensure that the subsequently built applications run on the latest and most stable environment.

[0055] S102, detecting whether the basic image version in the Dockerfile file is updated according to the repair version number;

[0056] In this embodiment, the continuous integration and continuous deployment system will read the base image version specified in the Dockerfile file. The Dockerfile file is usually a text file that contains all instructions for creating a Docker image. The file content includes the base image version number, working directory, and environment variables.

[0057] The continuous integration and continuous deployment system matches the read base image version with the latest obtained repair version number to confirm whether the base image version in the Dockerfile file is updated. If the continuous integration and continuous deployment system confirms that the base image version in the Dockerfile file is not updated, step S103 is executed.

[0058] S103, if it is determined that it is not updated, modify the Dockerfile file according to the repair version number;

[0059] In this embodiment, if it is determined that the base image version in the Dockerfile file has not been updated, the base image version in the Dockerfile file is replaced with the repaired base image version by specifying the base image instruction. After the replacement is completed, the Dockerfile file is saved. If it is determined to have been updated, it means that the current base image version is the latest version.

[0060] For example, in a Dockerfile file, the base image version in the file is nginx:1.18, and the fixed base image version is nginx:1.19. First, find the target line FROM nginx:1.18 in the Dockerfile file, then modify nginx:1.18 to nginx:1.19, and save the Dockerfile file after the modification is completed.

[0061] S104: Build an application image according to the modified Dockerfile file.

[0062] In this embodiment, the corresponding operations are performed in sequence according to the instructions specified in the modified Dockerfile file, including specifying the base image, installing dependencies, configuring the environment, etc. During the execution process, the Docker engine automatically handles all the underlying construction of the image according to the instructions in the Dockerfile file. The Docker engine is a tool for implementing the instructions in the Dockerfile file.

[0063] This embodiment automatically obtains the repair version number of the base image by listening to the code submission request, and detects whether the base image version in the Dockerfile file is updated. When it is determined that the base image version in the Dockerfile file has not been updated, the base image version number in the Dockerfile file is automatically modified to the repair version number, and the application image is built based on the modified Dockerfile file to ensure that the base image used to build the application image is the latest security version. The entire process does not require manual intervention, significantly improves the efficiency of repairing vulnerabilities, reduces the risk of configuration errors, and greatly shortens the window period for vulnerability repair, effectively improving security and stability. Specifically, by listening to the code submission request, the system can obtain the repair version number of the base image in real time, and automatically detect whether the base image version in the Dockerfile file has been updated. If it is detected that the base image version in the Dockerfile file has not been updated, the system will automatically modify the base image version number in the Dockerfile file to the latest repair version number. This process ensures that the base image used in the Dockerfile file is always the latest security version, thereby avoiding the security risks caused by the use of outdated images. Based on the modified Dockerfile file, the system automatically builds the application image. This construction process is fully automated, without manual intervention, and significantly improves the efficiency of repairing vulnerabilities. The automated process not only reduces the risk of configuration errors caused by manual operations, but also significantly shortens the window for vulnerability repair.

[0064] For the method of searching for the specified base image version in the Dockerfile file, you can use the from field of the Dockerfile file to perform a specified search, and use the script file to detect whether the base image version number is updated to ensure that the base image used in the Dockerfile file is always the latest security version. The specific description of the process of containerized deployment of system microservice applications after building the application image is as follows:

[0065] See also Figure 2 , Figure 2 Another embodiment of a method for building an application image provided by the present application includes:

[0066] S201. When a code submission request of the warehouse management system is monitored, a repair version number of the base image is obtained;

[0067] In this embodiment, step S201 is similar to step S101 in the above embodiment and will not be described again here.

[0068] S202, using a script file to detect whether the base image version in the Dockerfile file is consistent with the repair version number;

[0069] In this embodiment, the base image version in the Dockerfile file is detected by a shell script file, wherein the shell script file first needs to detect whether the Dockerfile file exists. When it is determined that the Dockerfile file already exists, the line containing "FROM" is searched in the Dockerfile file by the grep "FROM" Dockerfile instruction in the shell script file, and then the version of the base image is extracted by the awk'{print$2}' instruction, and the version number of the base image is assigned to a variable. The repair version number obtained is compared with the version number assigned in the variable to see if they are consistent.

[0070] S203, if they are inconsistent, determine that the base image version in the Dockerfile file is not updated;

[0071] If it is determined that the obtained repair version number is inconsistent with the version number assigned in the variable, it is determined that the basic image version in the Dockerfile file has not been updated; if it is determined that the obtained repair version number is consistent with the version number assigned in the variable, it is determined that the basic image version in the Dockerfile file is the latest version.

[0072] S204, when it is determined that it is not updated, modify the base image version number specified by the from field in the Dockerfile file according to the repair version number;

[0073] S205, building an application image according to the modified Dockerfile file;

[0074] In this embodiment, steps S204 to S205 are similar to steps S103 to S104 in the above-mentioned embodiment, and are not described in detail here.

[0075] S206, pushing the application image to the image warehouse;

[0076] In this embodiment, after the modified Dockerfile file has successfully built the application image, first log in to the image warehouse through the login instruction, and use the docker push command to push the application image to the specified image warehouse. The command format is docker push <warehouse address> / <warehouse name>:<label>.

[0077] The application image constructed in this embodiment has been uploaded to the designated image repository, and the application can be conveniently deployed and shared in different environments, thereby improving the portability and maintainability of the application.

[0078] S207: Perform containerized deployment of the system microservice application according to the address of the application image in the image repository.

[0079] In this embodiment, according to the address of the application image uploaded to the image warehouse, the docker pull command is used to download the application image to the local computer, and the command format is docker pull <image warehouse address> / <warehouse name>:<label>. A container is created according to the downloaded application image, and then the created container is started and run.

[0080] In this embodiment, containerized microservice applications are deployed based on application images downloaded from the image repository, which can achieve rapid deployment, elastic expansion and isolated operation of applications, improving the deployment efficiency and maintainability of applications. At the same time, the containerized deployment method also makes the deployment of applications in different environments more consistent and convenient.

[0081] This embodiment detects the base image version and the repair version number in the Dockerfile file through a script file, and can quickly and accurately determine whether the base image version needs to be updated, avoiding the tediousness of manual one-by-one inspection and possible omissions, and improving the efficiency and accuracy of version management. If inconsistency is detected, it is determined that the base image version in the Dockerfile file has not been updated, so that developers can promptly discover the difference in the base image version so that they can take corresponding measures to update it, and further ensure the consistency and stability of the application running environment. Pushing the application image to the image warehouse can conveniently share and use the image in different environments, improve the portability and deployment efficiency of the application, and also facilitate collaboration and management between team members. The containerized deployment of the system microservice application is carried out according to the address of the application image in the image warehouse, realizing a fast and automated deployment process, without the need for manual complex configuration and environment construction, greatly shortening the deployment time, and improving the availability and reliability of the system.

[0082] The following is an explanation of the containerized deployment process of the system microservice application. Figure 3 , Figure 3 Another embodiment of the method for building an application image provided by the present application includes:

[0083] S301. Modify the image address of the resource file in the container management platform according to the address of the application image in the image repository;

[0084] In this embodiment, the continuous integration and continuous deployment system first parses the resource file in the container management platform to identify the target image address. According to the identified target image address, the continuous integration and continuous deployment system updates the target image address in the resource file to the address of the current application image in the image repository to ensure that the application image in the container management platform is always the latest.

[0085] S302: Start the workload through the container management platform for containerized deployment.

[0086] In this embodiment, the continuous integration and continuous deployment system first pulls the modified application image in the container management platform. After the pull is completed, the container management platform will allocate corresponding computing resources to the workload according to resource requirements. Then, the continuous integration and continuous deployment system starts the workload, creates one or more container instances, and deploys these container instances to the specified nodes. During the container startup process, the system automatically performs a health check to ensure that all container instances are running normally. If a container instance is found to be abnormal, the system will automatically restart the instance to ensure the high availability of the workload.

[0087] This embodiment achieves centralized and automated management of containerized application deployment by modifying the image address of resource files in the container management platform. This means that when the application image needs to be updated, it only needs to be modified in one place, and there is no need to manually modify each related container configuration, which greatly improves management efficiency and flexibility. In addition, the container management platform is used to start the workload for containerized deployment, which simplifies the deployment process, reduces the possibility of manual operation and errors, and can quickly and consistently deploy applications, ensuring that the application status in each environment remains synchronized, which helps to improve the stability and reliability of the system and facilitates the expansion and management of applications.

[0088] The following describes the process of obtaining the image version. Figure 4 , Figure 4 Another embodiment of the method for building an application image provided by the present application includes:

[0089] S401. When a code submission request from the warehouse management system is monitored, an application image to be built is determined according to the code submission request;

[0090] In this embodiment, when the warehouse management system issues a code submission request, the continuous integration and continuous deployment system will start a listening program, which will continuously monitor the interface or event notification of the warehouse management system. Once the code submission request is received, the continuous integration and continuous deployment system will immediately perform a comprehensive analysis of the submitted code, including analyzing the structure of the code, file content, related configuration information, etc. Through these analyses, the continuous integration and continuous deployment system can accurately extract key information related to the construction of the application image, such as the name of the application image, version number, and the basic image it depends on. Then, based on this information, the continuous integration and continuous deployment system will search for the corresponding application image definition in its internal image management database or configuration file to determine the application image to be built, and can efficiently identify the specific application image that needs to be built, avoiding unnecessary construction operations on all application images, thereby saving time and resources.

[0091] S402: Determine a base image specified by the application image to be built, and obtain an identifier of the base image;

[0092] In this embodiment, after determining the application image to be built, the continuous integration and continuous deployment system will further parse the base image specified by the application image, and usually obtain detailed information about the base image from the configuration file, metadata or related configuration center of the application image, including the name and version number of the base image. Then, the continuous integration and continuous deployment system obtains the unique identifier of the base image through the image warehouse management system. After obtaining the identifier, the continuous integration and continuous deployment system uses the identifier to perform version query operations. This step provides an accurate basis for subsequent version detection and updates.

[0093] S403, sending a version query request to the target system according to the identifier of the base image, so that the target system queries the latest repair version number of the base image;

[0094] In this embodiment, after obtaining the identification of the base image, the continuous integration and continuous deployment system sends a version query request to the target system, which contains the identification information of the base image so that the target system can accurately identify and locate the base image that needs to be queried. The target system provides online vulnerability detection and repair services, which can repair image vulnerabilities and provide the version number after the vulnerability is repaired. When the target system receives this request, it searches for the corresponding base image version information in its internal version database or image warehouse according to the identification of the base image. The target system then analyzes and compares the version information to determine whether there is the latest repair version number. If so, the target system extracts the latest repair version number and prepares to return it to the system that initiated the request.

[0095] S404: Receive the repair version number returned by the target system.

[0096] In this embodiment, after completing the version detection, the target system will return the latest repair version number obtained to the continuous integration and continuous deployment system through the network connection. The continuous integration and continuous deployment system receives this version number and stores it in the local cache or database for subsequent processing and use.

[0097] For example, when using this base image, the continuous integration and continuous deployment system will first check whether there is a fixed version number in the local cache. If it exists, it will directly use this version number to pull or build the base image. If it does not exist, it will go to the image repository to obtain the repaired base image based on the version number.

[0098] This embodiment realizes the centralized and automated management of containerized application deployment by modifying the image address of the resource file in the container management platform, so that when the application image needs to be updated, there is no need to manually modify each related container configuration. By starting the workload for containerized deployment through the container management platform, the deployment process is simplified, and applications can be deployed quickly and consistently to ensure that the application status in each environment remains synchronized. By sending a version query request to the target system, the latest repair version number of the base image can be obtained in a timely manner, which can avoid security issues and business interruptions caused by vulnerabilities in the base image. By receiving the repair version number returned by the target system, the system can apply the latest fix in a timely manner, which enhances the security and stability of the system, helps to further reduce the security risks caused by vulnerabilities in the base image, and improves the reliability and availability of the system.

[0099] The following is a detailed description of the system for building application images provided by this application. Figure 5 , Figure 5 Another embodiment of the system for building an application image provided by the present application includes:

[0100] The acquisition unit 501 is used to acquire the repair version number of the basic image when monitoring the code submission request of the warehouse management system;

[0101] A detection unit 502 is used to detect whether the base image version in the Dockerfile file is updated according to the repair version number;

[0102] A modification unit 503 is used to modify the Dockerfile file according to the repair version number when the detection unit determines that it is not updated;

[0103] The building unit 504 is used to build an application image according to the modified Dockerfile file.

[0104] Optionally, a deployment unit 505 is further included, which is specifically used to:

[0105] Push the application image to the image repository;

[0106] According to the address of the application image in the image repository, the system microservice application is deployed in a container.

[0107] Optionally, the deployment unit 505 is further configured to:

[0108] Modify the image address of the resource file in the container management platform according to the address of the application image in the image warehouse;

[0109] Start the workload through the container management platform for containerized deployment.

[0110] Optionally, the acquiring unit 501 is further configured to:

[0111] When a code submission request from the warehouse management system is monitored, the application image to be built is determined according to the code submission request;

[0112] Determine the base image specified by the application image to be built, and obtain the identifier of the base image;

[0113] According to the identifier of the base image, the repair version number of the base image is obtained through the target system, and the target system is used to detect and repair the vulnerabilities of the base image.

[0114] Optionally, the acquiring unit 501 is further configured to:

[0115] Send a version query request to the target system according to the identifier of the base image, so that the target system queries the latest repair version number of the base image;

[0116] Receive the repair version number returned by the target system.

[0117] Optionally, the modifying unit 503 is further configured to:

[0118] Modify the base image version number specified in the from field in the Dockerfile file according to the repair version number.

[0119] Optionally, the detection unit 502 is further configured to:

[0120] Use the script file to check whether the base image version in the Dockerfile is consistent with the repair version number;

[0121] If they are inconsistent, it is determined that the base image version in the Dockerfile file has not been updated.

[0122] This application also provides a device for building an application image, see Figure 6 , Figure 6 An embodiment of a high-load data collection device provided in the present application includes:

[0123] Processor 601, memory 602, input and output unit 603, bus 604;

[0124] The processor 601 is connected to the memory 602, the input and output unit 603 and the bus 604;

[0125] The memory 602 stores a program, and the processor 601 calls the program to execute any of the above high-load data collection methods.

[0126] The present application also relates to a computer-readable storage medium on which a program is stored, wherein when the program is run on a computer, the computer is caused to execute any of the above methods.

[0127] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0128] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0129] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0130] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0131] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk, etc. Various media that can store program codes.

Claims

1. A method for building an application image, characterized in that: The method is applied to a continuous integration and continuous deployment system, and the method comprises: When a code submission request is received from the warehouse management system, the repair version number of the base image is obtained; Detect whether the base image version in the Dockerfile file is updated according to the repair version number; If it is determined that it is not updated, modify the Dockerfile file according to the repair version number; Build the application image according to the modified Dockerfile file.

2. The method according to claim 1, characterized in that After building the application image according to the modified Dockerfile file, the method further includes: Pushing the application image to the image warehouse; According to the address of the application image in the image repository, containerized deployment of the system microservice application is performed.

3. The method according to claim 2, characterized in that The containerized deployment of the system microservice application according to the address of the application image in the image repository includes: Modify the image address of the resource file in the container management platform according to the address of the application image in the image warehouse; The workload is started through the container management platform for containerized deployment.

4. The method according to claim 1, characterized in that: When a code submission request of the warehouse management system is monitored, the repair version number of the base image is obtained, including: When a code submission request from the warehouse management system is monitored, an application image to be built is determined according to the code submission request; Determine a base image specified by the application image to be built, and obtain an identifier of the base image; According to the identifier of the base image, a repair version number of the base image is obtained through a target system, and the target system is used to detect and repair vulnerabilities of the base image.

5. The method according to claim 4, characterized in that The step of obtaining the repair version number of the base image through the target system according to the identifier of the base image includes: Sending a version query request to the target system according to the identifier of the base image, so that the target system queries the latest repair version number of the base image; Receive the repair version number returned by the target system.

6. The method according to any one of claims 1 to 5, characterized in that Modify the Dockerfile file according to the repair version number, including: Modify the base image version number specified in the from field in the Dockerfile file according to the repair version number.

7. The method according to any one of claims 1 to 5, characterized in that The step of detecting whether the base image version in the Dockerfile file is updated according to the repair version number includes: Use a script file to detect whether the base image version in the Dockerfile is consistent with the repair version number; If they are inconsistent, it is determined that the base image version in the Dockerfile file has not been updated.

8. A system for building an application image, characterized in that: include: An acquisition unit, used to acquire the repair version number of the base image when a code submission request of the warehouse management system is monitored; A detection unit, used to detect whether the basic image version in the Dockerfile file is updated according to the repair version number; A modification unit, configured to modify the Dockerfile file according to the repair version number when the detection unit determines that the file is not updated; The build unit is used to build the application image according to the modified Dockerfile file.

9. A device for building an application image, characterized in that: The device comprises: Processor, memory, input-output unit, and bus; The processor is connected to the memory, the input and output unit, and the bus; The memory stores a program, and the processor calls the program to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a program stored thereon, wherein the program, when executed on a computer, performs the method according to any one of claims 1 to 7.

Images