Container mirror image scanning method and device, electronic equipment and readable storage medium

Abstract

The invention provides a container mirror image scanning method and device, electronic equipment and a readable storage medium, and belongs to the technical field of information security. The method comprises the following steps: in a container mirror image deployment process, continuously detecting a state transition boundary from an initialization stage to an operation stage; wherein in the initialization stage, an application program set on which the container mirror image depends is obtained, and the application program set comprises necessary application programs; in the operation stage, the container mirror image can be scanned to obtain full-amount vulnerability data. According to the method, the application program list can be obtained in the initialization stage to determine the necessary application program required by the operation of the application program list, so that the target vulnerability data corresponding to the necessary application program is filtered out when vulnerability scanning is executed in the operation stage, noise reduction processing on the container mirror image scanning result can be realized, and the operation efficiency is improved. The analysis burden in large-scale security maintenance is reduced, the security review cost is reduced, the risk detection efficiency is improved, and the method is easy to apply universally.

Description

Technical Field

[0001] The present disclosure belongs to the field of information security technology, and specifically relates to a container image scanning method, a container image scanning device, an electronic device, and a computer-readable storage medium. Background Art

[0002] With the continuous development of network communication technology and the widespread application of cloud-native architecture, containerization technology has become the core means of application deployment due to its advantages such as lightweight, fast deployment and efficient resource utilization. Container images are the basic components of application containerization deployment, which can determine the operating environment and software dependencies of the container, so their security is crucial.

[0003] Container image scanning is currently a commonly used security review method. It can perform in-depth scanning of all application components in the container image, thereby discovering vulnerabilities and handling them in a timely manner to prevent them from being maliciously exploited by third parties and causing security threats.

[0004] However, the cost of comprehensive scanning of container images is high, and a small container image may scan hundreds or thousands of vulnerabilities, which places a heavy burden on analysis in large-scale security maintenance. This leads to high security review costs and low risk detection efficiency, making it difficult to apply widely. Summary of the invention

[0005] The purpose of the embodiments of the present disclosure is to provide a container image scanning method, device, electronic device and readable storage medium, which can realize noise reduction processing of container image scanning results, reduce the analysis burden in large-scale security maintenance, reduce security review costs, and improve risk detection efficiency, and are easy to be widely used.

[0006] In order to solve the above technical problems, the present disclosure is implemented as follows:

[0007] In a first aspect, the present disclosure provides a container image scanning method, which may include: during the container image deployment process, continuously detecting the state transition boundary from the initialization phase to the running phase; wherein, when in the initialization phase, obtaining a set of applications on which the container image depends; the application set includes necessary applications; when in the running phase, scanning the container image to obtain full vulnerability data, and filtering the full vulnerability data to obtain target vulnerability data corresponding to the necessary applications.

[0008] Optionally, continuously detecting the state transition boundary from the initialization phase to the running phase includes: sending a check request to the container image; when the container image returns a keyword of not running, determining that it is in the initialization phase; when the container image returns a keyword of running, determining that it is in the running phase.

[0009] Optionally, the target vulnerability data corresponding to the necessary application is obtained by filtering the full amount of vulnerability data, including: obtaining a mapping relationship between each vulnerability and the application in the full amount of vulnerability data; and filtering the target vulnerability data corresponding to the necessary application in the full amount of vulnerability data based on the mapping relationship.

[0010] Optionally, scanning the container image to obtain the full amount of vulnerability data further includes: uniformly formatting the full amount of vulnerability data.

[0011] Optionally, the initialization phase refers to a process of preparing the environment and executing script commands to start an application corresponding to the container image.

[0012] Optionally, the running phase refers to the process of starting the application corresponding to the container image and providing services stably.

[0013] Optionally, the necessary applications include basic applications that support stable operation of the container image.

[0014] Optionally, the application set also includes non-essential applications, including other applications that support extended functions of the container image and redundant applications that support reliability of the container image.

[0015] In the second aspect, the present disclosure also provides a container image scanning device, which may include: a boundary detection module, which is used to continuously detect the state transition boundary from the initialization stage to the running stage during the container image deployment process; an application analysis module, which is used to obtain the set of applications that the container image depends on when it is in the initialization stage; the application set includes necessary applications; a vulnerability scanning module, which is used to scan the container image to obtain the full amount of vulnerability data when it is in the running stage, and filter the full amount of vulnerability data to obtain the target vulnerability data corresponding to the necessary applications.

[0016] Optionally, the boundary detection module is specifically used to send an inspection request to the container image; when the container image returns a keyword that is not running, it is determined to be in the initialization stage; when the container image returns a keyword that is running, it is determined to be in the running stage.

[0017] Optionally, the vulnerability scanning module is specifically used to obtain a mapping relationship between each vulnerability and an application program in the full amount of vulnerability data; and filter target vulnerability data corresponding to necessary applications in the full amount of vulnerability data based on the mapping relationship.

[0018] Optionally, the initialization phase refers to a process of preparing the environment and executing script commands to start an application corresponding to the container image.

[0019] Optionally, the running phase refers to the process of starting the application corresponding to the container image and providing services stably.

[0020] Optionally, the necessary applications include basic applications that support stable operation of the container image.

[0021] Optionally, the application set also includes non-essential applications, including other applications that support extended functions of the container image and redundant applications that support reliability of the container image.

[0022] In a third aspect, the present disclosure provides an electronic device, comprising a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the container image scanning method of the first aspect.

[0023] In a fourth aspect, the present disclosure provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the container image scanning method of the first aspect are implemented.

[0024] In a fifth aspect, the present disclosure provides a chip, comprising a processor and a communication interface, wherein the communication interface and the processor are coupled, and the processor is used to run a program or instruction to implement the steps of the container image scanning method of the first aspect.

[0025] In a sixth aspect, the present disclosure provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the steps of implementing the container image scanning method of the first aspect.

[0026] The present disclosure provides a container image scanning method, a container image scanning device, an electronic device and a computer-readable storage medium. In the process of container image deployment, the method continuously detects the state transition boundary from the initialization stage to the operation stage; wherein, when in the initialization stage, the application set on which the container image depends is obtained, and the application set includes necessary applications; when in the operation stage, the container image can be scanned to obtain the full amount of vulnerability data. The method can obtain a list of applications in the initialization stage to determine the necessary applications required for its operation, and then filter out the target vulnerability data corresponding to the necessary applications when performing vulnerability scanning in the operation stage, which can realize the noise reduction processing of the container image scanning results, reduce the analysis burden in large-scale security maintenance, reduce the cost of security review, and improve the efficiency of risk detection, which is easy to be widely used. Furthermore, the embodiment of the present disclosure avoids the problems of large noise and effective information dispersion caused by large-scale data collection and analysis of the entire life cycle by extracting and analyzing the applications in the initialization stage, and improves the accuracy of analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A flowchart of the steps of the container image scanning method provided by the embodiment of the present disclosure;

[0028] Figure 2 A schematic diagram of the process of Sysdig continuously detecting nginx containers provided in an embodiment of the present disclosure;

[0029] Figure 3 A schematic diagram of the structure of a container image scanning device provided in an embodiment of the present disclosure;

[0030] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure;

[0031] Figure 5 A hardware schematic diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0032] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0033] The terms "first", "second", etc. in the specification and claims of the present disclosure are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable when appropriate, so that the embodiments of the present disclosure can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0034] The container image scanning method provided by the embodiment of the present disclosure is described in detail below through specific embodiments and application scenarios in conjunction with the accompanying drawings.

[0035] Figure 1 This is a flowchart of the steps of the container image scanning method provided by the embodiment of the present disclosure. Figure 1 As shown, the method may include the following steps 101 to 103.

[0036] Step 101: During the container image deployment process, continuously detect the state transition boundary from the initialization phase to the running phase.

[0037] In the disclosed embodiment, the state transition boundary is the boundary information indicating the transition of the container image deployment process from the initialization phase to the operation phase. The continuous detection can be started from the start of the container image until the state transition boundary is detected, that is, the continuous detection can be started at the beginning of the initialization phase and ended when the initialization phase ends and the operation phase begins.

[0038] In the disclosed embodiment, the state transition boundary can be identified by detecting the change of response information during the container image deployment process, or the container image can be configured to actively prompt for identification after the startup is completed, or it can be realized by detecting the state change of the container life cycle. In the disclosed embodiment, there is no specific limitation on the identification form of the state transition boundary and the method of detecting the state transition boundary.

[0039] In an optional method embodiment of the present disclosure, the initialization phase refers to the process of preparing the environment and executing script commands to start the application corresponding to the container image.

[0040] In the disclosed embodiment, when starting a container, an initialization process may be performed by an Init Container. There may be one or more initialization containers, and multiple initialization containers may be executed sequentially in a defined order, and the initialization phase ends when all initialization containers are executed. Specifically, during the initialization phase, environment preparation may be performed, including calculation, configuration, and modification of environment parameters, and script commands may be executed to start applications that the container image depends on.

[0041] In an optional method embodiment of the present disclosure, the running phase refers to the process of starting the application corresponding to the container image and providing services stably.

[0042] In the embodiment of the present disclosure, all dependent applications of the container image are successfully started and can provide services stably, so it can be considered that its initialization phase is completed and it enters the running phase.

[0043] In an optional method embodiment of the present disclosure, in the aforementioned step 101, continuously detecting the state transition boundary from the initialization phase to the operation phase may include the following steps A1 to A3.

[0044] Step A1: Send a check request to the container image.

[0045] Step A2: When the container image returns a keyword that is not running, it is determined that it is in the initialization stage.

[0046] Step A3: When the container image returns the keyword "running", it is determined that the container image is in the running stage.

[0047] In the disclosed embodiment, a check request may be sent when the container image starts to start, and the check request may be continuously sent during the initialization phase, and may stop being sent when the initialization phase ends and enters the running phase. In response to the check request, the container image may return a keyword indicating the state of the process in which it is located. For example, when a keyword indicating that it is not running is returned, it indicates that it is still in the initialization phase, and when a keyword indicating that it is running is returned, it indicates that it is already in the running phase. During the continuous detection process, when the keyword changes from never running to running, it indicates that the state transition boundary from the initialization phase to the running phase has been detected.

[0048] For example, in Linux distributions, you can use the service command provided to continuously detect state transition boundaries, where the service command is used to manage system application start (start), stop (stop), status query (status), restart (restart), upgrade (update) and other functions. At this time, you can use the service command with the status option to initiate a check request to the container image, and perform keyword parsing on the returned content to determine the stage.

[0049] Taking the nginx (reverse proxy server) container as an example, after the startup, you can poll and send a check request for the "dockerexec -it nginx service nginx status" command. When the non-running keywords such as "Error" and "notrunning" are returned, it is determined that the nginx container is still in the initialization stage; when the running keywords such as "isrunning" are returned, it is determined that the nginx container is already in the running stage.

[0050] The above Linux distribution and nginx container are only examples, and it can also be httpd (Hypertext Protocol Service) and the like. Those skilled in the art can select a method for identifying state transition boundaries according to actual conditions and requirements, and the embodiments of the present disclosure do not impose specific limitations on this.

[0051] Step 102: When in the initialization phase, obtain a set of applications that the container image depends on; the application set includes necessary applications.

[0052] In the embodiment of the present disclosure, during the initialization phase, the startup status and events of the container image can be dynamically analyzed to determine the calling application, thereby obtaining the application set that the container image depends on. In the application set, necessary applications can be further distinguished, and the necessary applications can be determined by referring to information such as dependency relationships, calling methods, and calling records. The embodiment of the present disclosure does not impose specific restrictions on this.

[0053] In the embodiment of the present disclosure, a method for obtaining the application set that the container image depends on can be selected according to actual conditions and requirements, such as by analyzing it through a container visibility tool. Taking the nginx container as an example, the Sysdig (system mining) tool can be used to identify and monitor state transitions, as shown in the attached figure. Figure 2 The figure shows the process of Sysdig continuously detecting the nginx container. First, use Sysdig to start continuous detection through the "sysdig-wngnix.scap container.name=nginx" command, and the "-w" parameter specifies that the capture results are saved in "nginx.scap"; further, start the nginx container through "docker run-d-namenginx-p 80:80nginx" until Sysdig stops continuous detection at the state transition boundary; in the running stage, the "-p" parameter in "sysdig-p "%proc.name" -r nginx.scap" specifies that the filtered content is the application name for content parsing.

[0054] For example, the following Table 1 includes some applications that the nginx container depends on when initializing and the corresponding functional descriptions. Among them, the nginx container uses more applications to process configuration information when initializing.

[0055] Table 1

[0056]

[0057] In an optional method embodiment of the present disclosure, the necessary applications include basic applications that support stable operation of the container image.

[0058] In the embodiments of the present disclosure, the application set includes programs or library files that are called or relied upon during the startup of the container, which may include necessary applications, i.e., basic applications that support the stable operation of the container image. Necessary applications can be determined based on defined dependencies, historical call records, and other information. The application set may be all necessary applications, or it may include necessary applications and non-essential applications, and the embodiments of the present disclosure do not impose specific restrictions on this.

[0059] In an optional method embodiment of the present disclosure, the application set also includes non-essential applications, and the non-essential applications include other applications that support extended functions of the container image and redundant applications that support reliability of the container image.

[0060] In the embodiment of the present disclosure, non-essential applications can also be determined based on defined dependencies, historical call information, etc. Non-essential applications are redundant and unnecessary applications in the subsequent operation of the container, such as other applications that support extended functions of the container image, redundant applications that support the reliability of the container image, or other non-essential applications, which are not specifically limited in the embodiment of the present disclosure.

[0061] Step 103: When in the running stage, scan the container image to obtain the full amount of vulnerability data, and filter the full amount of vulnerability data to obtain the target vulnerability data corresponding to the necessary application.

[0062] In the embodiments of the present disclosure, during the operation phase, the container image can be scanned for vulnerabilities based on the needs of security review, and the scan results of all applications are the full amount of vulnerability data. On this basis, the full amount of vulnerability data can be screened based on the necessary applications determined in the initialization phase to obtain the target vulnerability data corresponding to the basic applications related to the operation of the container image, and on the basis of ensuring accuracy, remove noise interference and reduce the analysis burden. Furthermore, the embodiments of the present disclosure avoid the problems of large noise and scattered effective information caused by large-scale data collection and analysis throughout the life cycle by extracting and analyzing the applications in the initialization phase, thereby improving the accuracy of the analysis.

[0063] In an optional method embodiment of the present disclosure, in the aforementioned step 103, scanning the container image to obtain full vulnerability data also includes the following step B.

[0064] Step B: Format all vulnerability data in a unified manner.

[0065] In the disclosed embodiments, all vulnerability data obtained from scanning different applications can be uniformly formatted and converted into a data format readable for subsequent analysis. For example, all vulnerability data can be saved in json format, and a unified format conversion output of table conversion can be supported in container image scanning. For example, when using the Trivy tool for vulnerability scanning, the command "--format json" can be used to unify the table conversion format of the vulnerability scanning results.

[0066] In an optional method embodiment of the present disclosure, in the aforementioned step 103, filtering the full amount of vulnerability data to obtain target vulnerability data corresponding to the necessary application may include steps C1 to C2.

[0067] Step C1: Obtain the mapping relationship between each vulnerability and the application in the full vulnerability data.

[0068] In the disclosed embodiment, after obtaining the full amount of vulnerability data, the mapping relationship between each vulnerability and the application program can be further obtained, so as to determine the application programs to which they belong.

[0069] For example, taking the nginx container as an example, 142 full vulnerability data are obtained when the Trivy tool is used for vulnerability scanning. On this basis, the mapping relationship between each vulnerability and the application is obtained, and the 56 applications involved in the full vulnerability data are determined as shown in Table 2 below:

[0070] Table 2

[0071] libapt-pkg6.0 tar util-linux-extr libgcc-s1 libcurl4 libxml2 zlib1g libsystemd0 libtiff6 util-linux libkrb5-3 gcc-12-base libldap-2.5-0 sysvinit-utils libkrb5support ncurses-base passwd libgcrypt20 libpam-modul curl libuuid1 libk5crypto3 libblkid1 libc6 libpam0g bash libjbig0 mount libc-bin libnghttp2-14 libssl3 libpam-runtime libpam-module ncurses-bin perl-base libheif1 libtinfo6 gpgv apt libgssapi-krb5 libgnutls30 libmount1 nginx libexpat1 openssl libsmartcols1 coreutils libde265-0 libdav1d6 libstdc++6 libpng16-16 libudev1 login libaom3 bsdutils libxslt1.1

[0072] Step C2: Filter target vulnerability data corresponding to necessary applications from the full amount of vulnerability data based on the mapping relationship.

[0073] In the disclosed embodiment, necessary applications may be first screened out from the applications corresponding to the full amount of vulnerability data, and then the vulnerability data corresponding to the necessary applications may be used as target vulnerability data according to a mapping relationship.

[0074] As shown in Table 2 above, most of the applications will not be used during the running stage of the nginx container. The embodiment of the present disclosure obtains an application set as shown in Table 1 during the initialization stage, and filters Table 2 based on the application to determine that there are 4 target vulnerability data corresponding to the necessary application nginx, namely CVE-2024-7347, CVE-2009-4487, CVE-2013-0337, and CVE-2023-4448. Compared with the 142 full vulnerability data, the noise reduction rate reaches 97.17%.

[0075] The container image scanning method provided by the present disclosure continuously detects the state transition boundary from the initialization stage to the running stage during the container image deployment process; wherein, when in the initialization stage, the application set on which the container image depends is obtained, and the application set includes necessary applications; when in the running stage, the container image can be scanned to obtain the full amount of vulnerability data. The method can obtain a list of applications in the initialization stage to determine the necessary applications required for its operation, and then filter out the target vulnerability data corresponding to the necessary applications when performing vulnerability scanning in the running stage, which can achieve noise reduction processing of the container image scanning results, reduce the analysis burden in large-scale security maintenance, reduce the cost of security review, and improve the efficiency of risk detection, and is easy to be widely used. Furthermore, the embodiment of the present disclosure avoids the problems of large noise and scattered effective information caused by large-scale data collection and analysis throughout the life cycle by extracting and analyzing the applications in the initialization stage, thereby improving the accuracy of analysis.

[0076] The container image scanning method provided in the embodiment of the present disclosure may also be executed by a container image scanning device, or a control module in the container image scanning device for executing the container image scanning method. In the embodiment of the present disclosure, the container image scanning device executing the container image scanning method is taken as an example to illustrate the container image scanning device provided in the embodiment of the present disclosure.

[0077] Figure 3 A schematic diagram of the structure of a container image scanning device 300 provided in an embodiment of the present disclosure is shown in FIG. Figure 3 As shown in , the container image scanning device may include: a boundary detection module 301, which is used to continuously detect the state transition boundary from the initialization stage to the running stage during the container image deployment process; an application analysis module 302, which is used to obtain the application set on which the container image depends when it is in the initialization stage; the application set includes necessary applications; a vulnerability scanning module 303, which is used to scan the container image to obtain the full amount of vulnerability data when it is in the running stage, and to filter the full amount of vulnerability data to obtain the target vulnerability data corresponding to the necessary applications.

[0078] In an optional device embodiment of the present disclosure, the boundary detection module 301 is specifically used to send an inspection request to the container image; when the container image returns a keyword that is not running, it is determined to be in the initialization stage; when the container image returns a keyword that is running, it is determined to be in the running stage.

[0079] In an optional device embodiment of the present disclosure, the vulnerability scanning module 303 is specifically used to obtain the mapping relationship between each vulnerability and the application in the full amount of vulnerability data; and filter the target vulnerability data corresponding to the necessary application in the full amount of vulnerability data based on the mapping relationship.

[0080] In an optional device embodiment of the present disclosure, the initialization phase refers to the process of preparing the environment and executing script commands to start the application corresponding to the container image.

[0081] In an optional device embodiment of the present disclosure, the running stage refers to the process of starting the application corresponding to the container image and providing services stably.

[0082] In an optional device embodiment of the present disclosure, the necessary applications include basic applications that support stable operation of the container image.

[0083] In an optional device embodiment of the present disclosure, the application set also includes non-essential applications, and the non-essential applications include other applications that support extended functions of the container image and redundant applications that support the reliability of the container image.

[0084] The container image scanning device provided in the present disclosure continuously detects the state transition boundary from the initialization stage to the running stage during the container image deployment process; wherein, when in the initialization stage, the application set on which the container image depends is obtained, and the application set includes necessary applications; when in the running stage, the container image can be scanned to obtain the full amount of vulnerability data. The method can obtain a list of applications in the initialization stage to determine the necessary applications required for its operation, and then filter out the target vulnerability data corresponding to the necessary applications when performing vulnerability scanning in the running stage, which can achieve noise reduction processing of the container image scanning results, reduce the analysis burden in large-scale security maintenance, reduce the cost of security review, and improve the efficiency of risk detection, and is easy to be widely used. Furthermore, the embodiment of the present disclosure avoids the problems of large noise and scattered effective information caused by large-scale data collection and analysis throughout the life cycle by extracting and analyzing the applications in the initialization stage, thereby improving the accuracy of analysis.

[0085] The container image scanning device provided by the embodiment of the present disclosure can achieve Figure 1 to Figure 2 To avoid repetition, the various processes implemented in the method embodiment will not be described again here.

[0086] Figure 4 A schematic diagram of the structure of an electronic device 400 provided in an embodiment of the present disclosure is shown in FIG. Figure 4 As shown, the electronic device 400 may include a processor 401, a memory 402, and a program or instruction stored in the memory 402 and executable on the processor 401. When the program or instruction is executed by the processor 401, each process of the above-mentioned container image scanning method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0087] It should be noted that Figure 4 The electronic device 400 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0088] Figure 5 A hardware schematic diagram of an electronic device 500 provided in an embodiment of the present disclosure is shown in FIG. Figure 5As shown, the electronic device 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to the program stored in ROM (Read Only Memory) 502 or the program loaded from the storage part 508 to RAM (Random Access Memory) 503. Various programs and data required for system operation are also stored in RAM 503. CPU 501, ROM 502 and RAM 503 are connected to each other through bus 504. I / O (Input / Output) interface 505 is also connected to bus 504.

[0089] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a CRT (Cathode Ray Tube), an LCD (Liquid Crystal Display), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed so that a computer program read therefrom is installed into the storage section 508 as needed.

[0090] In particular, according to an embodiment of the present disclosure, the process described below with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 509, and / or installed from a removable medium 511. When the computer program is executed by a central processing unit (CPU501), various functions defined in the system of the present application are executed.

[0091] The embodiment of the present disclosure further provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above container image scanning method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0092] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as ROM, RAM, magnetic disk or optical disk.

[0093] The embodiment of the present disclosure further provides a chip, which includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement each process of the above container image scanning method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0094] It should be understood that the chip mentioned in the embodiments of the present disclosure may also be referred to as a system-level chip, a system chip, a chip system, or a system-on-chip chip, etc.

[0095] The embodiment of the present disclosure provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute the steps of the container image scanning method as described above, and can achieve the same technical effect. To avoid repetition, it will not be described here.

[0096] It should be noted that, in this article, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises one..." does not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the method and device in the embodiments of the present disclosure is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0097] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present disclosure, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, an electronic device, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present disclosure.

[0098] The embodiments of the present disclosure are described above in conjunction with the accompanying drawings, but the present disclosure is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present disclosure, ordinary technicians in this field can also make many forms without departing from the scope of protection of the purpose of the present disclosure and the claims, all of which are within the protection of the present disclosure.

Claims

1. A container image scanning method, characterized in that: The method comprises: During the container image deployment process, the state transition boundary from the initialization phase to the running phase is continuously detected; When in the initialization phase, obtaining a set of applications on which the container image depends; the set of applications includes necessary applications; When in the running stage, the container image is scanned to obtain full vulnerability data, and the target vulnerability data corresponding to the necessary application is obtained by filtering the full vulnerability data.

2. The method according to claim 1, characterized in that The continuously detecting the state transition boundary from the initialization phase to the operation phase includes: Sending a check request to the container image; When the container image returns a keyword that is not running, it is determined to be in the initialization stage; When the container image returns a keyword of "running", it is determined to be in the running stage.

3. The method according to claim 1, characterized in that The filtering to obtain the target vulnerability data corresponding to the necessary application from the full amount of vulnerability data includes: Obtaining a mapping relationship between each vulnerability and an application in the full amount of vulnerability data; The target vulnerability data corresponding to the necessary application is filtered from the full amount of vulnerability data based on the mapping relationship.

4. The method according to claim 1, characterized in that Scanning the container image to obtain full vulnerability data also includes: The entire amount of vulnerability data is uniformly formatted.

5. The method according to claim 1, characterized in that The initialization phase refers to the process of environment preparation, script command execution, and starting the application corresponding to the container image.

6. The method according to claim 1, characterized in that The running stage refers to the process in which the application corresponding to the container image is started and provides services stably.

7. The method according to claim 1, characterized in that The application set also includes non-essential applications; The necessary applications include basic applications that support the stable operation of the container image; The non-essential applications include other applications that support extended functions of the container image and redundant applications that support reliability of the container image.

8. A container image scanning device, characterized in that: The device comprises: The boundary detection module is used to continuously detect the state transition boundary from the initialization phase to the running phase during the container image deployment process; An application analysis module, used to obtain a set of applications that the container image depends on when in the initialization phase; the set of applications includes necessary applications; The vulnerability scanning module is used to scan the container image to obtain the full amount of vulnerability data when in the running stage, and filter the full amount of vulnerability data to obtain the target vulnerability data corresponding to the necessary application.

9. An electronic device, characterized in that: The method comprises a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the container image scanning method according to any one of claims 1 to 7.

10. A readable storage medium, characterized in that: The readable storage medium stores a program or an instruction, and when the program or the instruction is executed by the processor, the container image scanning method according to any one of claims 1 to 7 is implemented.

Images