Container image scanning method and device, electronic equipment and readable storage medium

Abstract

The present disclosure provides a container image scanning method and device, electronic equipment and readable storage medium, belonging to the technical field of information security. The method continuously detects the state transition boundary from the initialization stage to the running stage during the deployment of the container image; wherein, when in the initialization stage, the application program set relied on by the container image is obtained, and the application program set includes necessary application programs; when in the running stage, the container image can be scanned to obtain full vulnerability data. The method can obtain an application program list in the initialization stage to determine the necessary application programs required for running, and then filter out the target vulnerability data corresponding to the necessary application programs when performing vulnerability scanning in the running stage, so as to realize noise reduction processing of the container image scanning result, reduce the analysis burden in large-scale security maintenance, reduce the security review cost, improve the risk detection efficiency, and be easy to be widely applied.

Description

Technical Field

[0001] This disclosure belongs to the field of information security technology, specifically relating to a container image scanning method, a container image scanning device, an electronic device, and a computer-readable storage medium. Background Technology

[0002] With the continuous development of network communication technology and the widespread application of cloud-native architecture, containerization technology has become a core means of application deployment due to its advantages such as lightweight, rapid deployment, and efficient resource utilization. Container images are the basic components of containerized application deployment, determining the container's operating environment and software dependencies; therefore, their security is of paramount importance.

[0003] Container image scanning is a commonly used security auditing method. It can perform a deep scan of all application components in a container image to discover vulnerabilities and address them in a timely manner, preventing them from being maliciously exploited by third parties and causing security threats.

[0004] However, a full scan of container images is costly, and even a small container image may reveal hundreds or thousands of vulnerabilities. This places a heavy burden on analysis during large-scale security maintenance, resulting in high security audit costs and low risk detection efficiency, making it difficult to apply widely. Summary of the Invention

[0005] The purpose of this disclosure is to provide a container image scanning method, apparatus, electronic device, and readable storage medium that can reduce noise in container image scanning results, reduce the analysis burden in large-scale security maintenance, reduce security review costs, improve risk detection efficiency, and is easy to apply in a wide range of applications.

[0006] To solve the above-mentioned technical problems, this disclosure is implemented as follows:

[0007] In a first aspect, this disclosure provides a container image scanning method, which may include: continuously detecting the state transition boundary from the initialization phase to the running phase during the container image deployment process; wherein, during the initialization phase, obtaining the set of applications that the container image depends on; the set of applications includes necessary applications; and during the running phase, scanning the container image to obtain full vulnerability data, and filtering the full vulnerability data to obtain target vulnerability data corresponding to the necessary applications.

[0008] Optionally, continuous detection of the state transition boundary from the initialization phase to the running phase includes: sending a check request to the container image; determining that the container image is in the initialization phase when it returns a keyword indicating that it is not running; and determining that the container image is in the running phase when it returns a keyword indicating that it is running.

[0009] Optionally, filtering the target vulnerability data corresponding to the necessary applications from the full vulnerability data includes: obtaining the mapping relationship between each vulnerability and the application in the full vulnerability data; and filtering the target vulnerability data corresponding to the necessary applications from the full vulnerability data based on the mapping relationship.

[0010] Optionally, scanning container images to obtain full vulnerability data also includes: uniformly formatting the full vulnerability data.

[0011] Optionally, the initialization phase refers to the process of preparing the environment and executing script commands to start the application corresponding to the container image.

[0012] Optionally, the runtime phase refers to the process by which the application corresponding to the container image starts up and provides stable services.

[0013] Optionally, necessary applications include foundational applications that support the stable operation of container images.

[0014] Optionally, the application set also includes non-essential applications, which include other applications that support extended functionality of the container image, as well as redundant applications that support the reliability of the container image.

[0015] Secondly, this disclosure also provides a container image scanning device, which may include: a boundary detection module, used to continuously detect the state transition boundary from the initialization phase to the running phase during the container image deployment process; an application analysis module, used to obtain the set of applications that the container image depends on when it is in the initialization phase; the set of applications includes necessary applications; and a vulnerability scanning module, used to scan the container image to obtain full vulnerability data when it is in the running phase, and to filter the full vulnerability data to obtain target vulnerability data corresponding to necessary applications.

[0016] Optionally, the boundary detection module is specifically used to send an inspection request to the container image; when the container image returns a keyword indicating that it is not running, it determines that it is in the initialization phase; when the container image returns a keyword indicating that it is running, it determines that it is in the running phase.

[0017] Optionally, the vulnerability scanning module is specifically used to obtain the mapping relationship between each vulnerability and an application in the full vulnerability data; and to filter the target vulnerability data corresponding to the necessary applications in the full vulnerability data based on the mapping relationship.

[0018] Optionally, the initialization phase refers to the process of preparing the environment and executing script commands to start the application corresponding to the container image.

[0019] Optionally, the runtime phase refers to the process by which the application corresponding to the container image starts up and provides stable services.

[0020] Optionally, necessary applications include foundational applications that support the stable operation of container images.

[0021] Optionally, the application set also includes non-essential applications, which include other applications that support extended functionality of the container image, as well as redundant applications that support the reliability of the container image.

[0022] Thirdly, this disclosure provides an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the container image scanning method of the first aspect.

[0023] Fourthly, this disclosure provides a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the container image scanning method of the first aspect.

[0024] Fifthly, this disclosure provides a chip including a processor and a communication interface coupled to the processor, the processor being used to run programs or instructions to implement the steps of the container image scanning method of the first aspect.

[0025] In a sixth aspect, this disclosure provides a computer program product containing instructions that, when run on a computer, cause the computer to perform steps such as implementing the container image scanning method of the first aspect.

[0026] This disclosure provides a container image scanning method, a container image scanning device, an electronic device, and a computer-readable storage medium. During container image deployment, the method continuously monitors the state transition boundary from the initialization phase to the runtime phase. Specifically, during the initialization phase, it acquires the set of applications that the container image depends on, including necessary applications. During the runtime phase, it scans the container image to obtain full vulnerability data. This method can acquire an application list during the initialization phase to determine the necessary applications required for its operation. Then, during vulnerability scanning in the runtime phase, it filters out the target vulnerability data corresponding to the necessary applications. This enables noise reduction processing of the container image scan results, reducing the analysis burden in large-scale security maintenance, lowering security review costs, and improving risk detection efficiency, making it easy to widely apply. Furthermore, by extracting and analyzing applications during the initialization phase, this disclosure avoids the problems of high noise and scattered effective information caused by large-scale data collection and analysis throughout the entire lifecycle, thus improving the accuracy of the analysis. Attached Figure Description

[0027] Figure 1 A flowchart illustrating the steps of the container image scanning method provided in this embodiment of the disclosure;

[0028] Figure 2 This is a schematic diagram illustrating the process of Sysdig continuously detecting the nginx container provided in an embodiment of this disclosure;

[0029] Figure 3 This is a schematic diagram of the structure of the container image scanning device provided in the embodiments of this disclosure;

[0030] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure;

[0031] Figure 5 This is a hardware schematic diagram of an electronic device provided in an embodiment of the present disclosure. Detailed Implementation

[0032] The technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this disclosure. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0033] The terms "first," "second," etc., used in this disclosure and in the claims are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this disclosure can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0034] The container image scanning method provided in this disclosure will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0035] Figure 1 A flowchart illustrating the steps of a container image scanning method provided in this embodiment of the disclosure. Figure 1 As shown, the method may include the following steps 101 to 103.

[0036] Step 101: During the container image deployment process, continuously monitor the state transition boundaries from the initialization phase to the running phase.

[0037] In this embodiment of the disclosure, the state transition boundary is the demarcation information that marks the transition of the container image deployment process from the initialization phase to the runtime phase. This continuous monitoring can continue from the start of the container image deployment until the state transition boundary is detected; that is, continuous monitoring can start at the beginning of the initialization phase and end when the end of the initialization phase and the start of the runtime phase are determined.

[0038] In this embodiment, state transition boundaries can be identified by detecting changes in response information during container image deployment, by configuring the container image to actively indicate the boundary after startup, or by detecting state changes throughout the container's lifecycle. This embodiment does not impose specific limitations on the form of identifying state transition boundaries or the method of detecting them.

[0039] In an optional method embodiment of this disclosure, the initialization phase refers to the process of preparing the environment and executing script commands to start the application corresponding to the container image.

[0040] In this embodiment of the disclosure, initialization can be performed by an Init Container during container startup. There can be one or more Init Containers, which can be executed sequentially in a defined order, ending the initialization phase when all Init Containers have completed execution. Specifically, the initialization phase can include environment preparation, such as calculating, configuring, and modifying environment parameters, and executing script commands to start applications that the container image depends on.

[0041] In an optional embodiment of the method disclosed herein, the runtime phase refers to the process by which the application corresponding to the container image starts up and provides stable services.

[0042] In this embodiment of the disclosure, if all applications that the container image depends on are successfully started and can stably provide services, it can be considered that the initialization phase has ended and the running phase has begun.

[0043] In an optional embodiment of the method disclosed herein, the continuous detection of the state transition boundary from the initialization phase to the running phase in step 101 may include the following steps A1 to A3.

[0044] Step A1: Send an inspection request to the container image.

[0045] Step A2: When the container image returns the keyword "not running", determine that it is in the initialization phase.

[0046] Step A3: When the container image returns the keyword "running", determine that it is in the running stage.

[0047] In this embodiment of the disclosure, a check request can be sent when the container image starts up. This check request can be sent continuously during the initialization phase and stopped when the initialization phase ends and the container enters the running phase. In response to the check request, the container image can return a keyword indicating its current process state. For example, returning a keyword indicating "not running" indicates that it is still in the initialization phase, while returning a keyword indicating "running" indicates that it is already in the running phase. During continuous monitoring, when the keyword changes from "never running" to "running," it indicates that a state transition boundary from the initialization phase to the running phase has been detected.

[0048] For example, Linux distributions can use the provided `service` command for continuous detection of state transition boundaries. The `service` command manages system applications by starting, stopping, checking their status, restarting, and updating. In this case, the `service` command with the `status` option can send a check request to the container image and perform keyword parsing on the returned content to determine the current stage.

[0049] Taking the nginx (reverse proxy server) container as an example, after startup, you can poll and send a check request to the command "dockerexec -it nginx service nginx status". If it returns "Error" or "not running", it means that the nginx container is still in the initialization stage; if it returns "is running", it means that the nginx container is in the running stage.

[0050] The Linux distributions and nginx containers mentioned above are merely examples; other examples could include httpd (Hypertext Transfer Protocol Service). Those skilled in the art can choose the identification method for state transition boundaries based on actual conditions and needs, and this disclosure does not impose any specific limitations on this.

[0051] Step 102: During the initialization phase, obtain the set of applications that the container image depends on; the set of applications includes the necessary applications.

[0052] In this embodiment of the disclosure, during the initialization phase, the startup status and events of the container image can be dynamically analyzed to determine the calling applications, thereby obtaining the set of applications that the container image depends on. Within the application set, necessary applications can be further distinguished. These necessary applications can be determined by referring to information such as dependencies, calling methods, and calling records; this embodiment of the disclosure does not impose specific limitations in this regard.

[0053] In this embodiment of the disclosure, the method for obtaining the set of applications on which the container image depends can be selected according to actual conditions and needs, such as analysis using container visibility tools. Taking the nginx container as an example, the Sysdig (system mining) tool can be used for the identification and monitoring of state transitions, as shown in the attached figure. Figure 2 The diagram illustrates the process of Sysdig continuously monitoring the nginx container. First, Sysdig starts continuous monitoring using the command "sysdig-wngnix.scap container.name=nginx", with the "-w" parameter specifying that the captured results be saved to "nginx.scap". Next, the nginx container is started using "docker run-d --namenginx-p 80:80nginx", and Sysdig stops continuous monitoring at the state transition boundary. During the runtime phase, the "-p" parameter in "sysdig-p "%proc.name" -r nginx.scap" specifies that the filtered content is the application name for content parsing.

[0054] For example, Table 1 below includes some of the applications that the nginx container depends on during initialization, along with their corresponding functional descriptions. The nginx container uses a significant number of applications to process configuration information during initialization.

[0055] Table 1

[0056]

[0057] In an optional embodiment of the method disclosed herein, the necessary applications include basic applications that support the stable operation of container images.

[0058] In this embodiment of the disclosure, the application set includes programs or library files that are called or depended upon during container startup. This set may include essential applications, i.e., applications that support the stable operation of the container image. Essential applications can be determined based on defined dependencies, historical call records, and other information. The application set may consist entirely of essential applications, or it may include both essential and non-essential applications; this embodiment of the disclosure does not impose specific limitations in this regard.

[0059] In an optional embodiment of the method disclosed herein, the application set further includes non-essential applications, which include other applications that support extended functionality of the container image, as well as redundant applications that support the reliability of the container image.

[0060] In this embodiment of the disclosure, non-essential applications can also be identified based on defined dependencies, historical call information, etc. Non-essential applications are redundant or unnecessary applications that the container will not need to run in the future. These may include other applications that support the extended functionality of the container image, redundant applications that support the reliability of the container image, or other non-essential applications. This embodiment of the disclosure does not impose specific limitations on this.

[0061] Step 103: During the runtime phase, scan the container image to obtain full vulnerability data, and filter the full vulnerability data to obtain the target vulnerability data corresponding to the necessary applications.

[0062] In this embodiment of the disclosure, during the runtime phase, vulnerability scanning can be performed on the container image based on security review requirements, and the scan results for all applications constitute full vulnerability data. Based on this, the full vulnerability data can be filtered according to the necessary applications determined during the initialization phase to obtain target vulnerability data corresponding to the basic applications related to the container image's operation. This removes noise interference and reduces the analysis burden while ensuring accuracy. Furthermore, by extracting and analyzing applications during the initialization phase, this embodiment of the disclosure avoids the problems of high noise and scattered effective information caused by large-scale data collection and analysis throughout the entire lifecycle, thus improving the accuracy of the analysis.

[0063] In an optional method embodiment of this disclosure, step 103 above, which involves scanning the container image to obtain full vulnerability data, further includes step B.

[0064] Step B: Perform uniform formatting on all vulnerability data.

[0065] In this embodiment of the disclosure, the full vulnerability data obtained from scanning different applications can be uniformly formatted and converted into a data format readable for subsequent analysis. For example, the full vulnerability data can be saved in JSON format. In container image scanning, a unified format conversion output of table conversion can be supported. For example, when using the Trivy tool for vulnerability scanning, the command "--format json" can be used to unify the table conversion format of the vulnerability scanning results.

[0066] In an optional method embodiment of this disclosure, step 103, in which the target vulnerability data corresponding to the necessary application is obtained by filtering from the full vulnerability data, may include steps C1 to C2.

[0067] Step C1: Obtain the mapping relationship between each vulnerability and the application in the full vulnerability data.

[0068] In this embodiment of the disclosure, after obtaining the full amount of vulnerability data, the mapping relationship between each vulnerability and the application can be further obtained, thereby determining the application to which it belongs.

[0069] For example, taking the nginx container as an example, when using the Trivy tool to perform vulnerability scanning, 142 full vulnerability data points were obtained. Based on this, the mapping relationship between each vulnerability and the application was obtained, and the 56 applications involved in the full vulnerability data were identified as shown in Table 2 below:

[0070] Table 2

[0071] libapt-pkg6.0 tar util-linux-extr libgcc-s1 libcurl4 libxml2 zlib1g libsystemd0 libtiff6 util-linux libkrb5-3 gcc-12-base libldap-2.5-0 sysvinit-utils libkrb5support ncurses-base passwd libgcrypt20 libpam-modul curl libuuid1 libk5crypto3 libblkid1 libc6 libpam0g bash libjbig0 mount libc-bin libnghttp2-14 libssl3 libpam-runtim libpam-modul ncurses-bin perl-base libheif1 libtinfo6 gpgv apt libgssapi-krb5 libgnutls30 libmount1 nginx libexpat1 openssl libsmartcols1 coreutils libde265-0 libdav1d6 libstdc++6 libpng16-16 libudev1 login libaom3 bsdutils libxslt1.1

[0072] Step C2: Based on the mapping relationship, filter the target vulnerability data corresponding to the necessary applications from the full vulnerability data.

[0073] In this embodiment of the disclosure, necessary applications can be selected from the applications corresponding to the full set of vulnerability data, and then the vulnerability data corresponding to the necessary applications can be used as target vulnerability data according to the mapping relationship.

[0074] As shown in Table 2 above, most of these applications are not used during the runtime of the nginx container. In this embodiment of the disclosure, the set of applications shown in Table 1 is obtained during the initialization phase. Based on these applications, Table 2 is filtered to identify four target vulnerability data corresponding to the necessary application nginx: CVE-2024-7347, CVE-2009-4487, CVE-2013-0337, and CVE-2023-4448. Compared with the full set of 142 vulnerability data, the noise reduction rate reaches 97.17%.

[0075] The container image scanning method provided in this disclosure continuously detects the state transition boundary from the initialization phase to the runtime phase during container image deployment. Specifically, during the initialization phase, it acquires the set of applications that the container image depends on, including necessary applications. During the runtime phase, it scans the container image to obtain full vulnerability data. This method can acquire an application list during the initialization phase to determine the necessary applications required for its operation. Then, during vulnerability scanning in the runtime phase, it filters out the target vulnerability data corresponding to the necessary applications. This enables noise reduction of container image scan results, reduces the analysis burden in large-scale security maintenance, lowers security review costs, and improves risk detection efficiency, making it easy to widely apply. Furthermore, by extracting and analyzing applications during the initialization phase, the embodiments of this disclosure avoid the problems of high noise and scattered effective information caused by large-scale data collection and analysis throughout the entire lifecycle, thus improving the accuracy of the analysis.

[0076] The container image scanning method provided in this disclosure can also be executed by a container image scanning device, or a control module within that device for executing the container image scanning method. This disclosure uses the container image scanning device executing a container image scanning method as an example to illustrate the container image scanning apparatus provided in this disclosure.

[0077] Figure 3 This is a schematic diagram of the structure of the container image scanning device 300 provided in the embodiments of this disclosure, as shown below. Figure 3 As shown, the container image scanning device may include: a boundary detection module 301, used to continuously detect the state transition boundary from the initialization phase to the running phase during the container image deployment process; an application analysis module 302, used to obtain the set of applications that the container image depends on when it is in the initialization phase; the set of applications includes necessary applications; and a vulnerability scanning module 303, used to scan the container image to obtain full vulnerability data when it is in the running phase, and to filter and obtain target vulnerability data corresponding to necessary applications from the full vulnerability data.

[0078] In an optional device embodiment of this disclosure, the boundary detection module 301 is specifically used to send an inspection request to the container image; when the container image returns a keyword indicating that it is not running, it determines that it is in the initialization phase; when the container image returns a keyword indicating that it is running, it determines that it is in the running phase.

[0079] In an optional device embodiment of this disclosure, the vulnerability scanning module 303 is specifically used to obtain the mapping relationship between each vulnerability and an application in the full vulnerability data; and to filter the target vulnerability data corresponding to the necessary application in the full vulnerability data based on the mapping relationship.

[0080] In an optional device embodiment of this disclosure, the initialization phase refers to the process of preparing the environment and executing script commands to start the application corresponding to the container image.

[0081] In an optional embodiment of this disclosure, the running phase refers to the process of starting the application corresponding to the container image and providing stable services.

[0082] In an optional embodiment of this disclosure, the necessary applications include basic applications that support the stable operation of container images.

[0083] In an optional embodiment of this disclosure, the application set further includes non-essential applications, including other applications that support extended functionality of the container image, and redundant applications that support the reliability of the container image.

[0084] The container image scanning device provided in this disclosure continuously monitors the state transition boundary from the initialization phase to the runtime phase during container image deployment. Specifically, during the initialization phase, it acquires the set of applications the container image depends on, including necessary applications. During the runtime phase, it scans the container image to obtain full vulnerability data. This method can acquire an application list during the initialization phase to determine the necessary applications required for its operation. Then, during vulnerability scanning in the runtime phase, it filters out the target vulnerability data corresponding to the necessary applications. This enables noise reduction processing of the container image scan results, reducing the analysis burden in large-scale security maintenance, lowering security review costs, and improving risk detection efficiency, making it easily applicable to a wide range of applications. Furthermore, by extracting and analyzing applications during the initialization phase, this disclosure avoids the problems of high noise and scattered effective information caused by large-scale data collection and analysis throughout the entire lifecycle, thus improving analysis accuracy.

[0085] The container image scanning device provided in this disclosure can achieve... Figure 1 to Figure 2 To avoid repetition, the various processes implemented in the method implementation examples will not be described again here.

[0086] Figure 4 This is a schematic diagram of the structure of an electronic device 400 provided in an embodiment of the present disclosure, as shown below. Figure 4 As shown, the electronic device 400 may include a processor 401, a memory 402, and a program or instructions stored in the memory 402 and executable on the processor 401. When the program or instructions are executed by the processor 401, they implement the various processes of the above-described container image scanning method embodiments and achieve the same technical effects. To avoid repetition, they will not be described again here.

[0087] It should be noted that, Figure 4 The electronic device 400 shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments disclosed herein.

[0088] Figure 5 This is a hardware schematic diagram of an electronic device 500 provided in an embodiment of the present disclosure, such as... Figure 5As shown, the electronic device 500 includes a Central Processing Unit (CPU) 501, which can perform various appropriate actions and processes based on programs stored in ROM (Read-Only Memory) 502 or programs loaded from storage section 508 into RAM (Random Access Memory) 503. RAM 503 also stores various programs and data required for system operation. The CPU 501, ROM 502, and RAM 503 are interconnected via bus 504. An I / O (Input / Output) interface 505 is also connected to bus 504.

[0089] The following components are connected to I / O interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including CRT (Cathode Ray Tube), LCD (Liquid Crystal Display), etc., and speakers, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to I / O interface 505 as needed. Removable media 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 510 as needed so that computer programs read from them can be installed into storage section 508 as needed.

[0090] In particular, according to embodiments of this disclosure, the processes described below with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by the central processing unit (CPU 501), it performs various functions defined in the system of this application.

[0091] This disclosure also provides a readable storage medium storing a program or instructions that, when executed by a processor, implement the various processes of the above-described container image scanning method embodiments and achieve the same technical effects. To avoid repetition, these will not be described again here.

[0092] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as ROM, RAM, magnetic disk, or optical disk.

[0093] This disclosure also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described container image scanning method embodiments and achieve the same technical effect. To avoid repetition, it will not be described again here.

[0094] It should be understood that the chip mentioned in the embodiments of this disclosure may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0095] This disclosure provides a computer program product containing instructions that, when run on a computer, causes the computer to perform the steps of the container image scanning method described above, and achieves the same technical effect. To avoid repetition, further details are omitted here.

[0096] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this disclosure is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0097] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal (which may be a mobile phone, computer, electronic device, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this disclosure.

[0098] The embodiments of this disclosure have been described above with reference to the accompanying drawings. However, this disclosure is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this disclosure without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this disclosure.

Claims

1. A method for scanning container images, characterized in that, The method includes: During container image deployment, a check request is sent to the container image; when the container image returns the keyword "not running", it is determined that it is in the initialization phase; when the container image returns the keyword "running", it is determined that it is in the running phase; this is to continuously detect the state transition boundary from the initialization phase to the running phase; wherein, the initialization phase refers to the process of environment preparation, script command execution, and starting the application corresponding to the container image; the running phase refers to the process of the application corresponding to the container image starting up and providing stable services; During the initialization phase, the set of applications that the container image depends on is obtained; the set of applications includes necessary applications; the necessary applications include basic applications that support the stable operation of the container image. During the runtime phase, the container image is scanned to obtain full vulnerability data, and the target vulnerability data corresponding to the necessary application is obtained by filtering the full vulnerability data.

2. The method according to claim 1, characterized in that, The step of filtering the full set of vulnerability data to obtain the target vulnerability data corresponding to the necessary application includes: Obtain the mapping relationship between each vulnerability and the application in the full vulnerability data; Based on the mapping relationship, target vulnerability data corresponding to the necessary applications is filtered from the full vulnerability data.

3. The method according to claim 1, characterized in that, The process of scanning the container image to obtain full vulnerability data also includes: The entire set of vulnerability data was then formatted in a unified manner.

4. The method according to claim 1, characterized in that, The application set also includes non-essential applications; The non-essential applications include other applications that support the extended functionality of the container image, as well as redundant applications that support the reliability of the container image.

5. A container mirror scanning device, characterized in that, The device includes: A boundary detection module is used to send inspection requests to the container image during the container image deployment process; when the container image returns the keyword "not running", it determines that it is in the initialization phase; when the container image returns the keyword "running", it determines that it is in the running phase; in order to continuously detect the state transition boundary from the initialization phase to the running phase; wherein, the initialization phase refers to the process of environment preparation, script command execution and starting the application corresponding to the container image; the running phase refers to the process of the application corresponding to the container image starting up and providing stable services; The application analysis module is used to obtain the set of applications that the container image depends on during the initialization phase; the set of applications includes necessary applications; the necessary applications include basic applications that support the stable operation of the container image; The vulnerability scanning module is used to scan the container image to obtain full vulnerability data when it is in the running phase, and to filter the full vulnerability data to obtain target vulnerability data corresponding to the necessary application.

6. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the container image scanning method as described in any one of claims 1 to 4.

7. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a processor, implement the container image scanning method as described in any one of claims 1 to 4.

Images