Container asset security construction method, security management method and system

Abstract

The invention discloses a container asset security construction method, a security management method and a system. The method comprises the following steps: S01, performing static code scanning on a submitted source code; s02, when no security problem is found in static scanning, scanning a third-party dependency library of the source code and generating a software material list; s03, comparing the third-party dependency library with a CVE vulnerability library and an internally constructed dependency vulnerability library according to the generated software material list, and performing security detection on vulnerabilities of the third-party dependency library; s04, when no security problem is found in the security detection of the third-party dependency library, constructing an application mirror image by adopting the source code and the basic mirror image passing the security detection; and S05, performing security detection on the application layer mirror image in the application mirror image, deploying the application mirror image passing the security detection to a container platform, and constructing to form a container asset. According to the invention, the problems of low safety and high risk of container assets are solved.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and specifically relates to a container asset security construction method, a security management method and a system. Background Art

[0002] With the rapid development of cloud computing and containerization technology, the way applications are built and deployed has undergone fundamental changes. Containerization can improve development efficiency, simplify the deployment process, and solve the increasingly complex problem of application building and deployment, but it also introduces new security challenges. Traditional security measures are difficult to adapt to the rapid iteration of the development model, resulting in containerized applications facing potential security vulnerabilities and risks in the production environment. Therefore, the security of container assets is particularly important. Existing technologies use independent security checks at different stages and lack effective integration, resulting in delayed discovery and repair of security issues, increasing the risk of system attacks, and resulting in low security and high risk of containerized applications.

[0003] At present, there is an urgent need to develop a method and system covering the secure construction and security management of container assets to cope with the security challenges faced in modern software development and ensure the security of container assets throughout their life cycle, thereby reducing security vulnerabilities and risks and improving the reliability and stability of container asset applications. Summary of the invention

[0004] The purpose of the present invention is to provide a container asset security construction method, a security management method and a system to solve the problem of low security and high risk of container assets.

[0005] The present invention is achieved through the following technical solutions: Methods for building container asset security include: S01. Perform static code scanning on the submitted source code; S02. When no security issues are found in the static scan, the third-party dependency libraries of the source code are scanned and a software bill of materials is generated; S03. According to the generated software material list, the third-party dependency library is compared with the CVE vulnerability library and the internally constructed dependency vulnerability library, and the vulnerability of the third-party dependency library is security tested; S04. When no security issues are found in the security detection of the third-party dependent library, the application image is built using the source code and the basic image that has passed the security detection; S05. Perform security checks on the application layer images in the application images, deploy the application images that pass the security checks to the container platform, and build container assets.

[0006] In some embodiments, before step S01 , a step of detecting whether the submitted source code contains a set keyword is included. When the keyword is detected, steps S01 - S05 are executed to construct the container asset.

[0007] In some embodiments, the source code detection tool is templated into a yaml file and introduced into the .gitlab-ci.yml file through the include keyword of gitlab CI to automatically perform static code scanning on the submitted source code.

[0008] In some embodiments, the dependency library detection tool is templated into a yaml file and introduced into the .gitlab-ci.yml file through the include keyword of gitlab CI to automatically perform security detection on vulnerabilities of third-party dependency libraries.

[0009] In some embodiments, in step S01, when a static code scan finds a security issue, the found security issue is fed back to the code development end; And / or, in step S03, when a security problem is found in the security detection of the third-party dependent library, the found security problem is fed back to the code development end; And / or, in step S05, when a security problem is found in the security detection of the application layer image in the application image, the found security problem is fed back to the code development end.

[0010] The present invention also relates to a container asset security management method, which detects the security configuration of the container assets constructed using the above container asset security construction method during operation, and feeds back to the operation and maintenance end when security issues are found; And / or, receive the application image repaired by the operation and maintenance end, and redeploy the application image.

[0011] In some embodiments, the step of detecting the security configuration of the container asset during operation includes using the kube-bench tool to detect the problem of plain text storage of passwords in the security configuration of the container asset; including: Scan the configuration resource objects in the Kubernetes cluster, parse the content of the configuration resource objects, and detect whether the parsed information contains the set sensitive keywords; It is preferred to create a DaemonSet to periodically execute the security configuration script packaged into the Docker image; When the security configuration script is executed, it is used to scan the configuration resource objects in the Kubernetes cluster, parse the content of the configuration resource objects, and detect whether the parsed information contains the set sensitive keywords.

[0012] The present invention also relates to a container asset security construction system, which uses the above container asset security construction method to construct container assets, including: Static code scanning module, used to perform static code scanning on the submitted source code; The dependency library scanning module is used to scan the third-party dependency libraries of the source code and generate a software bill of materials, compare the third-party dependency libraries with the CVE vulnerability library and the internally built dependency vulnerability library, and perform security detection on the vulnerabilities of the third-party dependency libraries; The build management module is used to build the application image from the source code and the basic image that has passed the security test; The image management module is used to perform security detection on the application layer image in the application image; The deployment management module is used to deploy application images that have passed security checks to the container platform and build container assets.

[0013] In some embodiments, a process triggering module is further included, and the process triggering module is used to detect whether the submitted source code contains a set keyword, and trigger the execution of the above container asset security construction method to build the container asset when the keyword is detected.

[0014] The present invention also relates to a container asset security management system, comprising: Container asset security build system; The operation security check module is used to detect the security configuration of the created container assets during operation and provide feedback to the operation and maintenance end when security issues are found; And / or, the deployment management module is used to redeploy the application image after receiving the repaired application image from the operation and maintenance end.

[0015] Compared with the prior art, the present invention has the following advantages and beneficial effects: 1. The present invention performs static code scanning on the submitted source code, performs security detection on the vulnerabilities of the third-party dependent library, performs security detection on the basic image and application image, and deploys the application image that passes the security detection to the container platform to build container assets. It solves the problems of delayed discovery of security issues of container assets, independence of security detection at each stage, and high demand for manual intervention, ensures the security and controllability of container assets in the construction process, improves the security of container assets, reduces the risk of container assets being attacked, improves the reliability and stability of container asset applications, improves the efficiency and security of software development and operation and maintenance, and promotes the ability of enterprises to manage security issues during digital transformation.

[0016] 2. By detecting whether the submitted source code contains the set keywords, the process of the container asset security construction method is executed to build the container assets when the keywords are detected, avoiding frequent construction and deployment and the operation of security detection components in the process, reducing unnecessary waste of resources and time.

[0017] 3. The security issues found during static code scanning, third-party dependency library scanning, and application image scanning are fed back to the code development end, and the security issues found during the security configuration detection during the operation of container assets are fed back to the operation and maintenance end. This allows developers and operation and maintenance personnel to perform their respective duties, clarifies the work responsibilities and responsible parties of developers and operation and maintenance personnel, solves the problem of delayed security issue repair, and improves the efficiency of security issue repair.

[0018] 4. The security configuration script packaged in the Docker image is executed regularly through the created DaemonSet. When the security configuration script is executed, it is used to scan the configuration resource objects in the kubernetes cluster, parse the content of the configuration resource objects, and detect whether the parsed information contains the set sensitive keywords, so as to solve the problem that kube-bench cannot detect whether there is a plain text password in the configuration of the container application deployed in the kubernetes container cluster. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 This is a flow chart of a container asset security construction method and a security management method in an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments.

[0022] This invention integrates multiple tools and technologies to form an efficient and automated container security governance process. Starting from source code submission, the system goes through a series of automated construction, analysis, scanning, deployment, and monitoring steps to ensure the security of container applications throughout their entire life cycle. The process and principle of this invention to achieve secure construction of container assets and full life cycle security management are as follows. Figure 1 As shown: Developers submit code to the code repository, which triggers SonarQube to perform static code scanning and generate a static code scanning report. If there are security issues in the static code scanning report, feedback is given to the developer. If there are no security issues, proceed to the next step to start scanning the third-party dependency libraries of the source code and generate a software bill of materials. According to the generated software bill of materials, compare the third-party dependency libraries with the CVE vulnerability library and the internally built dependency vulnerability library. If there are security issues in the software bill of materials report, feedback will be given to the developer. If there are no security issues, proceed to the next step. Build the application image. When building, the operation and maintenance personnel will perform a security scan on the base image used in advance, and use the base image that has passed the security scan to build the application image. If the base image does not pass the security scan, the base image will be fed back to the operation and maintenance personnel for repair. Then, the application image is scanned. If the application image scan result shows security issues, feedback is given to the developer. If there are no security issues, the next step is executed to trigger the deployment of the application image. The application image will then run in the container platform in the form of a container. After the container assets are running, a security scan of the container assets is performed to scan whether there are problems with plain text password storage or weak account passwords in the container asset configuration. If the scan finds security issues, feedback is provided to the operation and maintenance personnel to repair them and trigger the redeployment of the application container, so that all links of the application container are safe and controllable throughout the entire life cycle.

[0023] Example 1 Methods for building container asset security include: S01. Perform static code scanning on the submitted source code; Developers on the code development side submit source code to the code repository, and the source code submission information is recorded and passed to the process trigger module.

[0024] Before executing step S01, the process trigger module detects whether the submitted source code contains a set keyword, and when the keyword is detected, steps S01-S05 are executed to build the container asset.

[0025] When the submitted source code is tested for set keywords through the built-in environment variable mechanism of the process trigger module, if the submitted source code information contains the keyword "deploy", the container asset security build process is triggered and steps S01-S05 are executed; if the keyword "deploy" is not detected, the container asset security build process will not be triggered. By detecting the set keywords to trigger the container asset security build process, frequent build deployment and the operation of security detection components in the process can be avoided, reducing unnecessary waste of resources and time.

[0026] The Sonarqube detection tool that performs static code scanning on the submitted source code is templated into a YAML file and introduced into the .gitlab-ci.yml file through the include keyword of gitlab CI. The submitted source code is automatically statically scanned to identify potential security vulnerabilities and code quality issues.

[0027] The tool components are abstracted into templated YAML files and introduced into the .gitlab-ci.yml file through the include keyword of gitlab CI, which realizes the full automation of the entire build process. It is also pluggable, and replacement is very simple and fast, with a high degree of automation.

[0028] In the continuous integration and continuous deployment of the entire application, the tool components are abstracted into template components, such as template components for Java and template components for nodejs. In the template components for Java, developers only need to introduce the header file components through the keyword include component in the project, without having to write a lot of gitlab-ci.yml file content, making the continuous integration process more templated. The gitlab-ci.yml file is the core configuration file of the continuous integration gitlabCI or continuous deployment gitlab CD process, which is used to define the project's integrated CI / deployment CD tasks and processes.

[0029] When security issues are found during static code scanning, a static scanning report is generated that includes the security issues found and the severity of the security issues. The static scanning report is fed back to the code development end. After receiving the static scanning report, the developers at the code development end will promptly and effectively repair the source code based on the security issues and the severity of the security issues in the static scanning report, and resubmit the code.

[0030] S02. When no security issues are found in the static scan, the third-party dependency libraries of the source code are scanned and a software bill of materials is generated; The dependency library detection tool is templated into a YAML file and introduced into the .gitlab-ci.yml file through the include keyword of gitlab CI to automatically perform security detection on vulnerabilities of third-party dependency libraries of the source code.

[0031] S03. According to the generated software material list, the third-party dependency library is compared with the CVE vulnerability library and the internally constructed dependency vulnerability library, and the vulnerability of the third-party dependency library is security tested; Using the Dependency-Check tool to identify vulnerabilities in third-party dependency libraries based on vulnerability data in the public CVE vulnerability database has significant limitations and can only detect vulnerabilities in dependency packages that have been disclosed on the public network. It is not possible to effectively identify and detect vulnerabilities in third-party dependency libraries based on dependency packages developed within the enterprise or vulnerabilities that have not yet been disclosed in the public database. This means that it is impossible to discover potential security risks in the company's customized dependency packages or special components developed by the team through Dependency-Check. In order to make up for this shortcoming, it is necessary to expand the scanning capabilities of Dependency-Check so that Dependency-Check can not only identify vulnerabilities in public network dependency libraries, but also identify security issues in dependency packages or special components developed within the company.

[0032] Creation and maintenance of internally built dependency vulnerability libraries, including: Since the company's internal development team usually uses customized dependency packages or special components, and these dependency packages or special components may find vulnerabilities or potential security risks during the development, testing and use process, the development team can create an internally built dependency vulnerability library IVD based on the company's internal customized dependency packages or special components. The internally built dependency vulnerability library can store the security issues of all dependency packages or special components developed within the company. Whenever vulnerabilities in all dependency packages or special components developed are discovered or fixed, the team can enter this information into the internally built dependency vulnerability library, so as to maintain and update the internally built dependency vulnerability library for subsequent scanning.

[0033] Extensions to the Dependency-Check tool, including: Based on the existing Dependency-Check tool, its vulnerability scanning function is expanded to add support for internally built dependency vulnerability libraries. When performing a scan, the Dependency-Check tool will generate a software bill of materials for the project, listing all the dependency libraries used.

[0034] The Dependency-Check tool matches the CVE vulnerability library while adding the matching of the internally built dependency vulnerability library. If the dependency packages in the project have records in the internally built dependency vulnerability library, the Dependency-Check tool can also include the vulnerabilities in these internally built dependency vulnerability libraries in the scan report.

[0035] Compared with the existing Dependency-Check tool, the expanded Dependency-Check tool can identify more vulnerability information, especially for customized dependency packages or special components developed within the company.

[0036] When security issues are found during security testing of third-party dependent libraries, a dependent library scan report is generated, and the security issues in the dependent library scan report are fed back to the code development end. After receiving the dependent library scan report, the developers at the code development end perform timely and effective repairs based on the security issues in the dependent library scan report.

[0037] S04. When no security issues are found in the security detection of the third-party dependent library, the application image is built using the source code and the basic image that has passed the security detection; In the existing application image building and scanning process, vulnerability scanning is usually performed on the entire application image including the base image vulnerabilities, which has the following defects: Repeatedly scan the vulnerabilities of the base image. Each time you build an application image, even if the base image has not changed, the scanning tool will still scan the system-level components such as the operating system, libraries, and tools, resulting in repetitive work and increased time costs.

[0038] It is impossible to distinguish the responsible parties. The vulnerability scanning results in the application image are a mixture of system-level and application-level vulnerabilities. It is difficult to distinguish which are system-level vulnerabilities that need to be repaired by operation and maintenance personnel and which are application-layer vulnerabilities that developers are responsible for. This mixed information may affect the efficiency of vulnerability repair.

[0039] In order to solve the above problems, the operation and maintenance personnel on the operation and maintenance side are responsible for maintaining and managing basic images, such as operating system images, application server images, etc. Before these basic images are used by developers, they are first scanned for system-level vulnerabilities by the operation and maintenance personnel through the Trivy plug-in. If the basic image fails the security scan, the security issues found will be fed back to the operation and maintenance side, and the operation and maintenance personnel on the operation and maintenance side will repair them.

[0040] Only when the base image has passed the vulnerability scan and has no serious system-level vulnerabilities, is it allowed to build an application image together with the source code that has passed the security test. This ensures that the base image selected when building the application image must have no vulnerabilities, avoids the generated application image containing vulnerabilities of the base image, ensures the security of the base image, and thus reduces the repeated scanning time during the development process.

[0041] Developers develop the application layer and build the application image based on the base image that has passed the security scan. Since the system-level vulnerabilities of the base image have been dealt with in advance, the vulnerability scan of the application image only focuses on security issues at the application level.

[0042] By separating the application layers of the base image and the application image for security testing, redundant work during application image scanning is greatly reduced, making the content of each image scan more focused. Developers can focus on fixing application-related vulnerabilities instead of dealing with system-level vulnerabilities, which improves the efficiency of vulnerability repair and fundamentally reduces potential security risks.

[0043] S05. Perform security checks on the application layer images in the application images, deploy the application images that pass the security checks to the container platform, and build container assets.

[0044] Use the trivy plug-in of the harbor image repository to perform security checks on the application layer images in the application image. Because the base image used to build the application image is already free of vulnerabilities, the speed of application image scanning will be greatly improved; When security issues are found in the security detection of the application layer of the application image, an application image scanning report is generated, and the security issues in the application image scanning report are fed back to the code development end. After receiving the application image scanning report, the developers at the code development end perform timely and effective repairs based on the security issues in the application image scanning report.

[0045] The scanning reports of the basic image and application image are fed back to the operation and maintenance personnel and developers respectively for repair, so that the developers and operation and maintenance personnel can perform their respective duties, clarify the job responsibilities and responsible parties of developers and operation and maintenance personnel, solve the problem of delayed repair of security issues, and improve the efficiency of repairing security issues.

[0046] After the application image passes the security scan, the deployment process of the application image is triggered. The application image is deployed to the container platform through the kubernetes tool, the container assets are built, and the deployment status is monitored to ensure that the container assets run successfully on the container platform.

[0047] Static code scanning is performed on the submitted source code, security detection is performed on the vulnerabilities of the third-party dependent libraries, and security detection is performed on the basic images and application images. The application images that pass the security detection are deployed to the container platform to build container assets. This solves the problems of delayed discovery of security issues of container assets, independence of security detection at each stage, and high demand for manual intervention. It ensures the security and controllability of container assets during the construction process, improves the security of container assets, reduces the risk of container assets being attacked, improves the reliability and stability of container asset applications, improves the efficiency and security of software development and operation and maintenance, and promotes enterprises to pay attention to and manage security issues during the digital transformation process.

[0048] Example 2 This embodiment relates to a container asset security management method, which detects the security configuration of the container asset constructed by the container asset security construction method in Embodiment 1 during operation, and feeds back to the operation and maintenance end when there is a security problem; And / or, receive the application image repaired by the operation and maintenance end, and redeploy the application image.

[0049] Testing the security configuration of container assets during operation includes using the kube-bench tool to detect the problem of plain text password storage in the container asset security configuration, and using the golin tool to detect the problem of weak account passwords in the container asset security configuration.

[0050] When security configuration detection of container assets during operation finds problems, a plain text password storage report detection and an account weak password detection report are generated and fed back to the operation and maintenance side. After the operation and maintenance personnel on the operation and maintenance side receive the plain text password storage report detection and the account weak password detection report, they will make timely and effective repairs based on the security issues in the plain text password storage report detection and the account weak password detection report.

[0051] After the container assets are running, continuous security checks are carried out to promptly identify and repair security issues, which solves the problem of insufficient monitoring after the container assets are running, ensures the safety and controllability of container assets during runtime, and enhances runtime security.

[0052] In some embodiments, the kube-bench tool is used to detect the problem of plain text storage of passwords in the container asset security configuration; including: Scan the configuration resource objects in the Kubernetes cluster, parse the content of the configuration resource objects, and detect whether the parsed information contains the set sensitive keywords.

[0053] To address the issue of plain text password storage, the kube-bench tool is used to test the following aspects: security configuration of Kubernetes API Server, Scheduler, Controller Manager and other components; security settings of etcd data storage and Worker nodes; network and access control policies; and certificate and encryption settings.

[0054] In some embodiments, the security configuration script packaged into the Docker image is periodically executed through the created DaemonSet; when the security configuration script is executed, it is used to scan the configuration resource objects in the kubernetes cluster, parse the content of the configuration resource objects, and detect whether the parsed information contains the set sensitive keywords.

[0055] Since kube-bench does not include security checks for application-level issues, such as whether ConfigMap and Secret contain plaintext passwords, kube-bench cannot detect whether the configuration ConfigMap and Secret of container applications deployed in the kubernetes container cluster contain plaintext passwords. Therefore, it is necessary to write a script to scan the configuration resource objects ConfigMap and Secret in the kubernetes cluster, parse the contents, and detect whether the sensitive information contains sensitive keywords such as "password", "key", and "token". Specifically, it includes: scanning scripts; packaging the scripts into a Docker image to run in Kubernetes; creating DaemonSet to periodically execute scanning tasks every 5 minutes.

[0056] Example 3 This embodiment relates to a container asset security construction system, which uses the container asset security construction method in Embodiment 1 to construct container assets, including: The static code scanning module integrates SonarQube to automatically perform static code analysis for static code scanning of submitted source code. It can also generate scan reports, identify security vulnerabilities, and provide feedback to developers. The dependency library scanning module uses Dependency-Check to scan the third-party dependency libraries of the source code and generate a software bill of materials. It compares the third-party dependency libraries with the CVE vulnerability library and the internally built dependency vulnerability library to perform security detection on the vulnerabilities of the third-party dependency libraries. The build management module integrates GitLab CI to automate the build process; it is used to build application images from source code and basic images that have passed security testing; The image management module is used to perform security detection on the application layer images in the application images. The container images are divided into basic images and application layer images. The images are managed through Harbor and the Trivy plug-in is integrated for security scanning. Periodically maintain a set of language base images (java, python, javascript, golang) without vulnerabilities to ensure that the base images selected when the source code executes the CI / CD module later are free of vulnerabilities, avoiding repeated scanning of system-level vulnerabilities during subsequent vulnerability scans. The security issues of the base images are maintained by the operation and maintenance personnel, and the security issues of the application images are the responsibility of the developers.

[0057] The deployment management module triggers the application deployment process and is used to deploy application images that pass security checks to the container platform and build container assets.

[0058] In some embodiments, a process triggering module is further included, and the process triggering module is used to detect whether the submitted source code contains a set keyword, and trigger the execution of the above container asset security construction method to build the container asset when the keyword is detected.

[0059] The system may include a source code management module that integrates GitLab to manage and version the submitted source code. Developers submit source code to the source code management module at the development end, and trigger the subsequent secure build process through the process trigger module.

[0060] Example 4 This embodiment involves a container asset security management system, including: The container asset security construction system in the above embodiment; And the operation security check module is used to detect the security configuration of the created container assets during operation, and feedback to the operation and maintenance end when security issues are found; And / or, the deployment management module is used to redeploy the application image after receiving the repaired application image from the operation and maintenance end.

[0061] During container operation, use Kube-bench and Golin tools to perform security baseline checks and weak password detection on the deployed application container to ensure that there are no security risks such as plain text passwords and weak account passwords. When problems are found, feedback is provided to the operation and maintenance personnel for repair.

[0062] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification or equivalent change made to the above embodiment based on the technical essence of the present invention shall fall within the protection scope of the present invention.

Claims

1. A method for securely building container assets, characterized in that: include: S01. Perform static code scanning on the submitted source code; S02. When no security issues are found in the static scan, the third-party dependency libraries of the source code are scanned and a software bill of materials is generated; S03. According to the generated software material list, the third-party dependency library is compared with the CVE vulnerability library and the internally constructed dependency vulnerability library, and the vulnerability of the third-party dependency library is security tested; S04. When no security issues are found in the security detection of the third-party dependent library, the application image is built using the source code and the basic image that has passed the security detection; S05. Perform security checks on the application layer images in the application images, deploy the application images that pass the security checks to the container platform, and build container assets.

2. The method for securely constructing container assets according to claim 1, characterized in that: Before step S01 , the method further includes the step of detecting whether the submitted source code contains a set keyword. When the keyword is detected, steps S01 - S05 are executed to construct the container asset.

3. The method for securely constructing container assets according to claim 1, characterized in that: The source code detection tool is templated into a YAML file and introduced into the .gitlab-ci.yml file through the include keyword of gitlab CI to automatically perform static code scanning on the submitted source code.

4. The method for securely constructing container assets according to claim 1, characterized in that: The dependency library detection tool is templated into a YAML file and introduced into the .gitlab-ci.yml file through the include keyword of gitlab CI to automatically perform security detection on vulnerabilities of third-party dependency libraries.

5. The method for securely constructing container assets according to claim 1, characterized in that: In step S01, when a security issue is found in the static code scan, the found security issue is fed back to the code development end; And / or, in step S03, when a security problem is found in the security detection of the third-party dependent library, the found security problem is fed back to the code development end; And / or, in step S05, when a security problem is found in the security detection of the application layer image in the application image, the found security problem is fed back to the code development end.

6. A container asset security management method, characterized in that: Detecting the security configuration of the container assets constructed by the container asset security construction method according to any one of claims 1 to 5 during operation, and providing feedback to the operation and maintenance end when security issues are found; And / or, receive the application image repaired by the operation and maintenance end, and redeploy the application image.

7. The container asset security management method according to claim 6, characterized in that: The steps of detecting the security configuration of container assets during operation include using the kube-bench tool to detect the problem of plain text storage of passwords in the security configuration of container assets; include: Scan the configuration resource objects in the Kubernetes cluster, parse the content of the configuration resource objects, and detect whether the parsed information contains the set sensitive keywords; It is preferred to create a DaemonSet to periodically execute the security configuration script packaged into the Docker image; When the security configuration script is executed, it is used to scan the configuration resource objects in the Kubernetes cluster, parse the content of the configuration resource objects, and detect whether the parsed information contains the set sensitive keywords.

8. A container asset security construction system, characterized in that: The container asset is constructed by using the container asset security construction method according to any one of claims 1 to 5, comprising: Static code scanning module, used to perform static code scanning on the submitted source code; The dependency library scanning module is used to scan the third-party dependency libraries of the source code and generate a software bill of materials, compare the third-party dependency libraries with the CVE vulnerability library and the internally built dependency vulnerability library, and perform security detection on the vulnerabilities of the third-party dependency libraries; The build management module is used to build the application image from the source code and the basic image that has passed the security test; The image management module is used to perform security detection on the application layer image in the application image; The deployment management module is used to deploy application images that have passed security checks to the container platform and build container assets.

9. The container asset security construction system according to claim 8, characterized in that: It also includes a process triggering module, which is used to detect whether the submitted source code contains a set keyword, and trigger the execution of the container asset security construction method according to any one of claims 1 to 5 to construct the container asset when the keyword is detected.

10. A container asset security management system, characterized in that: include: The container asset security construction system according to claim 8 or 9; The operation security check module is used to detect the security configuration of the created container assets during operation and provide feedback to the operation and maintenance end when security issues are found; And / or, the deployment management module is used to redeploy the application image after receiving the application image repaired by the operation and maintenance end.

Images