Mirror image dependency relationship determination method and device, equipment and medium

Abstract

The invention relates to a mirror image dependency relationship determination method and device, equipment and a medium. The method comprises the following steps: acquiring mirror image meta-information of a target mirror image in a business warehouse; wherein the mirror image meta-information comprises layer information of each mirror image layer in the target mirror image, and the layer information of each mirror image layer comprises a layer identifier and layer construction information of the mirror image layer; according to the layer information of each mirror image layer in the target mirror image, determining a layer hash value of each mirror image layer in the target mirror image; and determining a dependency relationship between the target mirror image and the basic mirror image according to the layer hash value and the layer construction information of each mirror image layer in the target mirror image and the basic hash value of the basic mirror image in the business warehouse. By adopting the method, the dependency relationship between the mirror images in the warehouse can be accurately analyzed.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, in particular to a mirror image dependency relationship determination method, device, equipment and medium. BACKGROUND

[0002] At present, with the wide application of containerization technology, as the core carrier of business system deployment, the construction, management and dependency tracing of mirror image have become the key link of enterprise R&D and operation system. The essence of mirror image is that multiple read-only mirror image layers are stacked in the construction order, and the mirror image is usually constructed based on the base image. By reusing the core layer of the base image, the construction process can be simplified, and the storage and transmission cost can be reduced. Enterprises usually maintain multiple standardized base images, and need to clarify the dependency relationship between the target image and the base image to support the governance operations such as vulnerability repair and version upgrade of the base image.

[0003] The existing mirror image dependency relationship analysis method depends on the FROM instruction in the Dockerfile of the mirror image to identify the base image, but there are a large number of cases without Dockerfile or incomplete Dockerfile in actual scenarios, which leads to the inability to identify the dependency relationship and reflect the complete layer dependency link. SUMMARY

[0004] Therefore, it is necessary to provide a mirror image dependency relationship determination method, device, equipment and medium to accurately analyze the dependency relationship between the mirror images in the warehouse.

[0005] In a first aspect, the present application provides a mirror image dependency relationship determination method, comprising:

[0006] Obtaining mirror image meta information of a target image in a business warehouse; wherein the mirror image meta information comprises layer information of each mirror image layer in the target image, and the layer information of each mirror image layer comprises a layer identifier and layer construction information of the mirror image layer;

[0007] Determining layer hash values of each mirror image layer in the target image according to the layer information of each mirror image layer in the target image;

[0008] Determining the dependency relationship between the target image and the base image according to the layer hash values and layer construction information of each mirror image layer in the target image, and the base hash value of the base image in the business warehouse.

[0009] In one embodiment, determining the layer hash values of each mirror image layer in the target image according to the layer information of each mirror image layer in the target image comprises:

[0010] Splicing the layer identifier and layer construction information of each mirror image layer in the target image to obtain layer splicing information;

[0011] hashing the layer splicing information to obtain a layer hash value of the mirror image layer.

[0012] In one of the embodiments, the determining of the dependency relationship between the target image and the base image according to the layer hash values of the mirror image layers in the target image and the base hash value of the base image in the service warehouse comprises:

[0013] For each mirror image layer in the target image, the build time of the mirror image layer is determined according to the layer build information of the mirror image layer.

[0014] The mirror image layers in the target image are sorted according to the build times of the mirror image layers.

[0015] Based on the sorting result, the mirror image layers in the target image are combined to obtain at least two combination sets.

[0016] The dependency relationship between the target image and the base image is determined according to the layer hash value of each mirror image layer in each combination set and the base hash value of the base image in the service warehouse.

[0017] In one of the embodiments, the determining of the dependency relationship between the target image and the base image according to the layer hash values of the mirror image layers in each combination set and the base hash value of the base image in the service warehouse comprises:

[0018] For any combination set, the combination hash value of the combination set is determined according to the layer hash values of the mirror image layers in the combination set.

[0019] The dependency relationship between the target image and the base image is determined according to the consistency between the combination hash values of the combination sets and the base hash value.

[0020] In one of the embodiments, the base hash value comprises the layer hash value corresponding to each mirror image layer in the base image.

[0021] The determining of the dependency relationship between the target image and the base image according to the consistency between the combination hash values of the combination sets and the base hash value comprises:

[0022] For any combination set, the combination hash value of the combination set is compared with the layer hash value corresponding to each mirror image layer in the base image for consistency.

[0023] If the combination hash value of any combination set is consistent with the layer hash value corresponding to any mirror image layer in the base image, it is determined that there is a dependency relationship between the target image and the base image.

[0024] In one of the embodiments, the image meta information of the target image in the service warehouse is acquired, including:

[0025] A standard interface of the service warehouse is called to acquire a mirror list file and a configuration file of the target image;

[0026] From the mirror list file, the layer identifier of each image layer in the target image is extracted;

[0027] From the configuration file, the layer construction information of each image layer in the target image is extracted.

[0028] In one of the embodiments, the target image is a service image in the service warehouse, and the service image is constructed based on the base image or other images.

[0029] In a second aspect, the application further provides a device for determining an image dependency relationship, comprising:

[0030] An information acquisition module is configured to acquire image meta information of a target image in a service warehouse, wherein the image meta information comprises layer information of each image layer in the target image, and the layer information of each image layer comprises a layer identifier and layer construction information of the image layer;

[0031] A hash determination module is configured to determine layer hash values of each image layer in the target image according to the layer information of each image layer in the target image;

[0032] A dependency determination module is configured to determine a dependency relationship between the target image and a base image in the service warehouse according to the layer hash values and layer construction information of each image layer in the target image and a base hash value of the base image.

[0033] In a third aspect, the application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0034] Image meta information of a target image in a service warehouse is acquired, wherein the image meta information comprises layer information of each image layer in the target image, and the layer information of each image layer comprises a layer identifier and layer construction information of the image layer;

[0035] Layer hash values of each image layer in the target image are determined according to the layer information of each image layer in the target image;

[0036] A dependency relationship between the target image and a base image in the service warehouse is determined according to the layer hash values and layer construction information of each image layer in the target image and a base hash value of the base image.

[0037] In a fourth aspect, the present application also provides a computer readable storage medium having stored thereon a computer program, which, when executed by a processor, implements the following steps:

[0038] obtaining image meta information of a target image in the business warehouse; wherein the image meta information comprises layer information of each image layer in the target image, and the layer information of each image layer comprises layer identification and layer construction information of the image layer;

[0039] determining layer hash values of the image layers in the target image according to the layer information of the image layers in the target image;

[0040] determining a dependency relationship between the target image and the base image according to the layer hash values and the layer construction information of the image layers in the target image, and the base hash value of the base image in the business warehouse.

[0041] In a fifth aspect, the present application also provides a computer program product comprising a computer program, which, when executed by a processor, implements the following steps:

[0042] obtaining image meta information of a target image in the business warehouse; wherein the image meta information comprises layer information of each image layer in the target image, and the layer information of each image layer comprises layer identification and layer construction information of the image layer;

[0043] determining layer hash values of the image layers in the target image according to the layer information of the image layers in the target image;

[0044] determining a dependency relationship between the target image and the base image according to the layer hash values and the layer construction information of the image layers in the target image, and the base hash value of the base image in the business warehouse.

[0045] The above image dependency relationship determination method, device, equipment and medium obtain image meta information of a target image in the business warehouse; wherein the image meta information comprises layer information of each image layer in the target image, and the layer information of each image layer comprises layer identification and layer construction information of the image layer; layer hash values of the image layers in the target image are determined according to the layer information of the image layers in the target image; and a dependency relationship between the target image and the base image is determined according to the layer hash values and the layer construction information of the image layers in the target image, and the base hash value of the base image in the business warehouse. Based on the dependency recognition of the layer hash values, the above scheme can directly reuse the cached layers of the base image, has fast analysis speed, and reduces time complexity; the legal base image version of the target image is determined through the dependency relationship, which avoids the problem of inconsistent environment caused by the random selection of the base image by the R&D personnel, ensures the accuracy of the image dependency relationship analysis, and can assist the organization in quickly identifying the explosion range of the base image with 0day vulnerabilities. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 Here is an example diagram of dependency analysis provided in one embodiment;

[0048] Figure 2 This is a flowchart illustrating a method for determining mirror dependencies in one embodiment;

[0049] Figure 3 This is a schematic diagram of the process for determining the layer hash value of each mirror layer in one embodiment;

[0050] Figure 4 This is a flowchart illustrating the process of determining the dependency relationship between the target image and the base image in one embodiment;

[0051] Figure 5 This is a flowchart illustrating the process of determining the dependency relationship between the target image and the base image in another embodiment;

[0052] Figure 6 This is a flowchart illustrating the method for determining mirror dependencies in another embodiment;

[0053] Figure 7 This is a structural block diagram of a mirror dependency determination device in one embodiment;

[0054] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0056] When determining container image dependencies, the basic principle is to compare whether the image layers are identical. Identical layers are defined as those whose layer identifier (layerId) and build information are completely identical. The limitation of comparing only layerId is that it cannot distinguish empty layers because the layerId is calculated by hashing the file content of a layer in the image; when a layer is empty, it has no layerId.Figure 1 As shown in the figure, the dependency analysis example provided by the embodiment of the application. It is assumed that the business image is built based on the Openjdk2 image, and the images of Openjdk1 and Openjdk2. The contents of the lower two layers are the same, and only the uppermost layer is different, which is identified by using different LABEL. If only layerId is used for comparison, it will be found that the lower three layers of the business image are exactly the same as the two Openjdk images, and there is no way to accurately determine which base image is.

[0057] The problem of comparing only the image layer construction information: even if it is the same Dockerfile (configuration file), the images built at different times may be different, and comparing the image layer construction information alone is not enough to ensure the consistency of the image layer. Therefore, although the comparison of layerId and image layer construction information is accurate, it will increase the memory occupation, and at the same time, due to the relatively long content of the comparison, it will increase the CPU burden.

[0058] To solve the above problems, the image dependency relationship determination method provided by the embodiment of the application can be applied to the application environment for analyzing the dependency relationship between the container images in the business warehouse. The image dependency relationship determination method provided by the embodiment of the application can be executed by a computer device, which can be a server or a terminal with strong computing power.

[0059] In an exemplary embodiment, as shown in the figure, an image dependency relationship determination method is provided, which is taken as an example of a server for illustration, and specifically includes the following steps: Figure 2

[0060] S201, obtaining the image meta information of the target image in the business warehouse.

[0061] The business warehouse is a special warehouse used by enterprises or organizations to store, manage, and distribute related digital assets. The image meta information includes the layer information of each image layer in the target image, and the layer information of each image layer includes the layer identifier and the layer construction information of the image layer. The target image is a business image in the business warehouse, and the business image is built based on a base image or other images.

[0062] Optionally, the metadata of the target image can be obtained by calling the standard interface of the business warehouse, and the metadata can be preprocessed to extract the layer identifier and the layer construction information of each image layer of the target image.

[0063] ​Exemplarily, an image list file and a configuration file of the target image can be acquired; from the image list file, layer identifiers of each image layer in the target image are extracted; from the configuration file, layer construction information of each image layer in the target image is extracted. Exemplarily, an API (Application Programming Interface) interface of the business warehouse can be called to acquire the image list file and the configuration file. It should be noted that the image list file contains image identifiers of all images in the business warehouse.

[0064] S202, layer hash values of each image layer in the target image are determined according to the layer information of each image layer in the target image.

[0065] Optionally, for each image layer of the target image, the layer information of each image layer can be subjected to hash operation based on a hash algorithm to obtain the layer hash values of each image layer in the target image.

[0066] S203, a dependency relationship between the target image and the base image is determined according to the layer hash values and the layer construction information of each image layer in the target image and the base hash values of the base image in the business warehouse.

[0067] Optionally, information of all base images in the business warehouse can be extracted, and hash values of all image layers of each base image are calculated to establish a correspondence between the hash values of the image layers of the base image and the base image.

[0068] Further, for each image layer, the layer hash value of the image layer and the base hash value of the base image can be compared for consistency, and if the layer hash value of any image layer in the target image is consistent with the base hash value of the base image, it is determined that there is a dependency relationship between the target image and the base image.

[0069] In the above image dependency relationship determination method, image meta-information of a target image in a business warehouse is acquired; the image meta-information includes layer information of each image layer in the target image, and the layer information of each image layer includes a layer identifier and layer construction information of the image layer; layer hash values of each image layer in the target image are determined according to the layer information of each image layer in the target image; and a dependency relationship between the target image and a base image is determined according to the layer hash values and the layer construction information of each image layer in the target image and the base hash values of the base image in the business warehouse. The above scheme, based on layer hash value-based dependency recognition, can directly reuse the cached layers of the base image, has fast analysis speed and reduces time complexity; through the dependency relationship, the legal base image version of the target image is determined, avoiding the problem of inconsistent environment caused by random selection of base images by developers, ensuring the accuracy of image dependency relationship analysis, and assisting the organization in quickly identifying the explosion range of the base image with 0day vulnerability.

[0070] Optionally, in one exemplary embodiment, as shown in Figure 3 A method for determining a layer hash value of each image layer is provided, and specifically includes the following steps:

[0071] S301, for each image layer in the target image, concatenating the layer identifier and the layer construction information of the image layer to obtain layer concatenation information.

[0072] Optionally, for each image layer in the target image, the layer identifier and the layer construction information of the image layer can be concatenated based on a preset concatenation order to obtain the layer concatenation information.

[0073] S302, performing a hash operation on the layer concatenation information to obtain a layer hash value of the image layer.

[0074] Optionally, the standardized layer concatenation information can be converted into a byte stream, and the final hash value is calculated by a specified hash algorithm to ensure the uniqueness of the result. For example, the layer concatenation information string can be converted into a UTF-8 byte stream, the SHA256 algorithm is used to perform a hash operation on the byte stream, and the hash result is converted into a 64-bit hexadecimal string.

[0075] In this embodiment, based on the layer identifier (storage unique) + construction information (behavior unique) dual dimensions, it is ensured that the calculated layer hash value can uniquely identify the storage + behavior characteristics of the image layer, and the accuracy and pertinence of the obtained layer hash value are guaranteed.

[0076] Optionally, in one embodiment, as shown in Figure 4 A method for determining the dependency relationship between the target image and the base image is provided, and specifically includes the following steps:

[0077] S401, for each image layer in the target image, determining the construction time of the image layer according to the layer construction information of the image layer.

[0078] Optionally, all image layers of the target image are traversed, and the standardized construction time is extracted from the construction information of each image layer to ensure that the time format is uniform and sortable.

[0079] S402, sorting the image layers in the target image according to the construction time of each image layer.

[0080] Optionally, the construction time is sorted in ascending order after standardization, i.e. the image layer constructed first is in the front, and a time-ordered layer list is obtained, which completely restores the construction process of the image, and ensures that the combination set conforms to the superposition logic of the image layer.

[0081] S403, based on the sorting result, combining the image layers in the target image to obtain at least two combination sets.

[0082] Optionally, the core of the combination set is to cover the possible layer reuse scenarios of the base image, and to generate continuous prefix combinations and continuous intermediate combinations in priority, at least two groups are generated to ensure that no dependency relationship is missed. For example, assuming that the target image includes four image layers, and the sorted result obtained after sorting is layer 1, layer 2, layer 3, and layer 4; at least two combination sets can include (layer 1), (layer 1, layer 2), (layer 1, layer 2, layer 3), and (layer 1, layer 2, layer 3, layer 4).

[0083] S404, according to the layer hash value of each image layer in each combination set and the base hash value of the base image in the service warehouse, the dependency relationship between the target image and the base image is determined.

[0084] Optionally, the layer hash value of each combination set can be compared with the base hash value of the base image, and the dependency relationship is determined according to the principle of continuous hash complete matching. If the layer hash value sequence in the combination set is completely consistent with a certain continuous hash value sequence of the base image, the target image depends on the corresponding layer of the base image, and then the overall dependency relationship is derived.

[0085] In this embodiment, based on the construction time sorting + continuous layer combination + hash complete matching, the misjudgment caused by single layer hash collision is avoided, and the accuracy of the dependency relationship identification is ensured; at least two combination sets are generated to cover the prefix layer, the intermediate layer and other scenarios, and the reuse relationship of the base image layer is avoided to be missed; the matching result can be associated with the specific layer identifier and the hash value, which is convenient for subsequent verification and problem positioning.

[0086] Optionally, in one embodiment, as shown in Figure 5 a method for determining the dependency relationship between a target image and a base image is provided, which specifically includes the following steps:

[0087] S501, for any combination set, the combination hash value of the combination set is determined according to the layer hash value of the image layer in the combination set.

[0088] The combination hash value is the hash value of the combination set.

[0089] Optionally, for any combination set, the combination hash value can be generated by layer hash value order splicing → standardization → hash operation, and the combination hash value uniquely represents the overall characteristics of the combination set.

[0090] For example, according to the sorting order of the layers in the combination set, all layer hash values are spliced with a fixed separator to ensure that the order does not change, the spliced string is converted into a UTF-8 byte stream, and SHA256 hash is performed on the byte stream to output a 64-bit hexadecimal string.

[0091] S502, determine the dependency relationship between the target image and the base image according to the consistency between the combination hash value of each combination set and the base hash value.

[0092] Optionally, the base hash value includes a layer hash value corresponding to each image layer in the base image; on this basis, for any combination set, the group hash value of the combination set is compared with the layer hash value corresponding to each image layer in the base image for consistency; if there is any combination set whose combination hash value is consistent with the layer hash value corresponding to any image layer in the base image, it is determined that there is a dependency relationship between the target image and the base image. Specifically, the combination hash values of all combination sets can be compared one by one with each layer hash value in the base hash value set, and the dependency is determined according to the rules. For example, if the combination hash value of the combination set A is completely consistent with the base hash value set, it means that the comparison is successful, and it can be determined that there is a dependency relationship between the target image and the base image.

[0093] In this embodiment, complex sequence matching is not required, only combination hash calculation + full set comparison is required, the execution efficiency is high, it does not depend on additional information such as layer order and construction time of the base image, only the layer hash value set of the base image is required, and it is suitable for more business warehouse scenarios.

[0094] Figure 6 For another flowchart of the image dependency relationship determination method in the embodiment, on the basis of the above embodiment, the present embodiment provides an optional example of an image dependency relationship determination method. In combination with Figure 6 , the specific implementation process is as follows:

[0095] S601, call the standard interface of the business warehouse to obtain the image manifest file and the configuration file of the target image.

[0096] S602, extract the layer identifier of each image layer in the target image from the image manifest file.

[0097] S603, extract the layer construction information of each image layer in the target image from the configuration file.

[0098] S604, splice the layer identifier and the layer construction information of each image layer to obtain the layer splicing information of each image layer.

[0099] S605, perform hash operation on each layer splicing information of each image layer to obtain the layer hash value of each image layer.

[0100] S606, determine the construction time of each image layer in the target image according to the layer construction information of each image layer in the target image.

[0101] S607, sort the image layers in the target image according to the construction time of each image layer in the target image.

[0102] S608, based on the sorting results, combine each image layer in the target image to obtain at least two combined sets.

[0103] S609, determine the dependency relationship between the target image and the base image based on the layer hash value of each image layer in each combination set and the base hash value of the base image in the business repository.

[0104] Optionally, for any set of images, a combined hash value is determined based on the layer hash values ​​of the image layers within the set; the dependency between the target image and the base image is determined based on the consistency between the combined hash values ​​and the base hash values ​​of each set. The base hash value includes the layer hash value corresponding to each image layer in the base image.

[0105] Optionally, for any set of combinations, the group hash value of the set is compared with the layer hash value corresponding to each image layer in the base image for consistency. If the group hash value of any set of combinations is consistent with the layer hash value corresponding to any image layer in the base image, then it is determined that there is a dependency relationship between the target image and the base image.

[0106] The specific processes of S601-S609 described above can be found in the description of the above method embodiments. Their implementation principles and technical effects are similar, and will not be repeated here.

[0107] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0108] Based on the same inventive concept, this application also provides a mirror dependency determination apparatus for implementing the mirror dependency determination method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more mirror dependency determination apparatus embodiments provided below can be found in the limitations of the mirror dependency determination method described above, and will not be repeated here.

[0109] In one exemplary embodiment, such as Figure 7As shown, a mirror dependency determination device 700 is provided, including: an information acquisition module 710, a hash determination module 720, and a dependency determination module 730, wherein:

[0110] The information acquisition module 710 is used to acquire the image metadata of the target image in the business warehouse; wherein, the image metadata includes the layer information of each image layer in the target image, and the layer information of each image layer includes the layer identifier and layer construction information of the image layer.

[0111] The hash determination module 720 is used to determine the layer hash value of each image layer in the target image based on the layer information of each image layer in the target image.

[0112] The dependency determination module 730 is used to determine the dependency relationship between the target image and the base image based on the layer hash value and layer construction information of each image layer in the target image, as well as the base hash value of the base image in the business repository.

[0113] The aforementioned image dependency determination device acquires the image metadata of the target image from the business repository. This image metadata includes layer information for each image layer in the target image, with each layer's information including its layer identifier and layer construction information. Based on the layer information of each image layer in the target image, the device determines the layer hash value of each image layer. Based on the layer hash values ​​and construction information of each image layer in the target image, and the base hash value of the base image in the business repository, the device determines the dependency relationship between the target image and the base image. This solution, based on layer hash value-based dependency identification, can directly reuse cached layers from the base image, resulting in fast analysis and reduced time complexity. By clarifying the legitimate base image version of the target image through dependency relationships, it avoids inconsistencies caused by developers arbitrarily selecting base images, ensuring the accuracy of image dependency analysis and assisting organizations in quickly identifying the exploit range of base images containing zero-day vulnerabilities.

[0114] In one embodiment, the hash determination module 720 is specifically used for:

[0115] For each image layer in the target image, the layer identifier and layer construction information of the image layer are concatenated to obtain the layer concatenation information; the layer concatenation information is then hashed to obtain the layer hash value of the image layer.

[0116] In one embodiment, the dependency determination module 730 includes:

[0117] The time determination unit is used to determine the build time of each image layer in the target image based on the layer build information of the image layer.

[0118] The sorting unit is used to sort the image layers in the target image according to their build time.

[0119] The combination determination module is used to combine the image layers in the target image based on the sorting results to obtain at least two combination sets.

[0120] The dependency determination unit is used to determine the dependency relationship between the target image and the base image based on the layer hash value of each image layer in each combination set and the base hash value of the base image in the business repository.

[0121] In one embodiment, the dependency determination unit includes:

[0122] The hash determination unit is used to determine the combination hash value of a combination set for any combination set, based on the layer hash value of the mirror layer in the combination set.

[0123] Dependency determination is a unit used to determine the dependency relationship between the target image and the base image based on the consistency between the combined hash value and the base hash value of each combination set.

[0124] In one embodiment, the base hash value includes the layer hash value corresponding to each image layer in the base image; the dependency determination unit is specifically used for:

[0125] For any set of combinations, the group hash value of the set is compared with the layer hash value corresponding to each image layer in the base image. If the group hash value of any set of combinations is consistent with the layer hash value corresponding to any image layer in the base image, then it is determined that there is a dependency relationship between the target image and the base image.

[0126] In one embodiment, the information acquisition module 710 is specifically used for:

[0127] Call the standard interface of the business repository to obtain the image manifest file and configuration file of the target image; extract the layer identifier of each image layer in the target image from the image manifest file; extract the layer build information of each image layer in the target image from the configuration file.

[0128] In one embodiment, the target image is a business image in the business repository, which is built based on a base image or other images.

[0129] The modules in the aforementioned mirror dependency determination device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0130] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 8As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and databases. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media to run. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a method for determining mirror dependencies.

[0131] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0132] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0133] Obtain the image metadata of the target image in the business repository; wherein, the image metadata includes the layer information of each image layer in the target image, and the layer information of each image layer includes the layer identifier and layer construction information of the image layer;

[0134] Determine the layer hash value of each image layer in the target image based on the layer information of each image layer in the target image;

[0135] Based on the layer hash values ​​and layer construction information of each image layer in the target image, as well as the base hash value of the base image in the business repository, the dependency relationship between the target image and the base image is determined.

[0136] In one embodiment, when the processor executes a computer program to determine the layer hash value of each image layer in the target image based on the layer information of each image layer in the target image, it also performs the following steps:

[0137] For each image layer in the target image, the layer identifier and layer construction information of the image layer are concatenated to obtain the layer concatenation information; the layer concatenation information is then hashed to obtain the layer hash value of the image layer.

[0138] In one embodiment, when the processor executes a computer program to determine the dependency relationship between the target image and the base image based on the layer hash values ​​and layer build information of each image layer in the target image, and the base hash value of the base image in the business repository, it also performs the following steps:

[0139] For each image layer in the target image, determine the build time of the image layer based on the layer build information; sort the image layers in the target image according to their build times; combine the image layers in the target image based on the sorting results to obtain at least two combination sets; determine the dependency relationship between the target image and the base image based on the layer hash value of each image layer in each combination set and the base hash value of the base image in the business repository.

[0140] In one embodiment, when the processor executes a computer program to determine the dependency between the target image and the base image based on the layer hash value of each image layer in each combination set and the base hash value of the base image in the business repository, it also performs the following steps:

[0141] For any set of images, determine the combined hash value of the set based on the layer hash value of the image layer in the set; determine the dependency relationship between the target image and the base image based on the consistency between the combined hash value and the base hash value of each set of images.

[0142] In one embodiment, the base hash value includes the layer hash value corresponding to each image layer in the base image; when the processor executes the computer program to determine the dependency relationship between the target image and the base image based on the consistency between the combined hash value of each combination set and the base hash value, it also performs the following steps:

[0143] For any set of combinations, the group hash value of the set is compared with the layer hash value corresponding to each image layer in the base image. If the group hash value of any set of combinations is consistent with the layer hash value corresponding to any image layer in the base image, then it is determined that there is a dependency relationship between the target image and the base image.

[0144] In one embodiment, when the processor executes a computer program to obtain the image metadata of a target image in the business repository, it also performs the following steps:

[0145] Call the standard interface of the business repository to obtain the image manifest file and configuration file of the target image; extract the layer identifier of each image layer in the target image from the image manifest file; extract the layer build information of each image layer in the target image from the configuration file.

[0146] In one embodiment, the target image is a business image in the business repository, which is built based on a base image or other images.

[0147] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0148] Obtain the image metadata of the target image in the business repository; wherein, the image metadata includes the layer information of each image layer in the target image, and the layer information of each image layer includes the layer identifier and layer construction information of the image layer;

[0149] Determine the layer hash value of each image layer in the target image based on the layer information of each image layer in the target image;

[0150] Based on the layer hash values ​​and layer construction information of each image layer in the target image, as well as the base hash value of the base image in the business repository, the dependency relationship between the target image and the base image is determined.

[0151] In one embodiment, when the processor executes a computer program to determine the layer hash value of each image layer in the target image based on the layer information of each image layer in the target image, it also performs the following steps:

[0152] For each image layer in the target image, the layer identifier and layer construction information of the image layer are concatenated to obtain the layer concatenation information; the layer concatenation information is then hashed to obtain the layer hash value of the image layer.

[0153] In one embodiment, when the processor executes a computer program to determine the dependency relationship between the target image and the base image based on the layer hash values ​​and layer build information of each image layer in the target image, and the base hash value of the base image in the business repository, it also performs the following steps:

[0154] For each image layer in the target image, determine the build time of the image layer based on the layer build information; sort the image layers in the target image according to their build times; combine the image layers in the target image based on the sorting results to obtain at least two combination sets; determine the dependency relationship between the target image and the base image based on the layer hash value of each image layer in each combination set and the base hash value of the base image in the business repository.

[0155] In one embodiment, when the processor executes a computer program to determine the dependency between the target image and the base image based on the layer hash value of each image layer in each combination set and the base hash value of the base image in the business repository, it also performs the following steps:

[0156] For any set of images, determine the combined hash value of the set based on the layer hash value of the image layer in the set; determine the dependency relationship between the target image and the base image based on the consistency between the combined hash value and the base hash value of each set of images.

[0157] In one embodiment, the base hash value includes the layer hash value corresponding to each image layer in the base image; when the processor executes the computer program to determine the dependency relationship between the target image and the base image based on the consistency between the combined hash value of each combination set and the base hash value, it also performs the following steps:

[0158] For any set of combinations, the group hash value of the set is compared with the layer hash value corresponding to each image layer in the base image. If the group hash value of any set of combinations is consistent with the layer hash value corresponding to any image layer in the base image, then it is determined that there is a dependency relationship between the target image and the base image.

[0159] In one embodiment, when the processor executes a computer program to obtain the image metadata of a target image in the business repository, it also performs the following steps:

[0160] Call the standard interface of the business repository to obtain the image manifest file and configuration file of the target image; extract the layer identifier of each image layer in the target image from the image manifest file; extract the layer build information of each image layer in the target image from the configuration file.

[0161] In one embodiment, the target image is a business image in the business repository, which is built based on a base image or other images.

[0162] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0163] Obtain the image metadata of the target image in the business repository; wherein, the image metadata includes the layer information of each image layer in the target image, and the layer information of each image layer includes the layer identifier and layer construction information of the image layer;

[0164] Determine the layer hash value of each image layer in the target image based on the layer information of each image layer in the target image;

[0165] Based on the layer hash values ​​and layer construction information of each image layer in the target image, as well as the base hash value of the base image in the business repository, the dependency relationship between the target image and the base image is determined.

[0166] In one embodiment, when the processor executes a computer program to determine the layer hash value of each image layer in the target image based on the layer information of each image layer in the target image, it also performs the following steps:

[0167] For each image layer in the target image, the layer identifier and layer construction information of the image layer are concatenated to obtain the layer concatenation information; the layer concatenation information is then hashed to obtain the layer hash value of the image layer.

[0168] In one embodiment, when the processor executes a computer program to determine the dependency relationship between the target image and the base image based on the layer hash values ​​and layer build information of each image layer in the target image, and the base hash value of the base image in the business repository, it also performs the following steps:

[0169] For each image layer in the target image, determine the build time of the image layer based on the layer build information; sort the image layers in the target image according to their build times; combine the image layers in the target image based on the sorting results to obtain at least two combination sets; determine the dependency relationship between the target image and the base image based on the layer hash value of each image layer in each combination set and the base hash value of the base image in the business repository.

[0170] In one embodiment, when the processor executes a computer program to determine the dependency between the target image and the base image based on the layer hash value of each image layer in each combination set and the base hash value of the base image in the business repository, it also performs the following steps:

[0171] For any set of images, determine the combined hash value of the set based on the layer hash value of the image layer in the set; determine the dependency relationship between the target image and the base image based on the consistency between the combined hash value and the base hash value of each set of images.

[0172] In one embodiment, the base hash value includes the layer hash value corresponding to each image layer in the base image; when the processor executes the computer program to determine the dependency relationship between the target image and the base image based on the consistency between the combined hash value of each combination set and the base hash value, it also performs the following steps:

[0173] For any set of combinations, the group hash value of the set is compared with the layer hash value corresponding to each image layer in the base image. If the group hash value of any set of combinations is consistent with the layer hash value corresponding to any image layer in the base image, then it is determined that there is a dependency relationship between the target image and the base image.

[0174] In one embodiment, when the processor executes a computer program to obtain the image metadata of a target image in the business repository, it also performs the following steps:

[0175] Call the standard interface of the business repository to obtain the image manifest file and configuration file of the target image; extract the layer identifier of each image layer in the target image from the image manifest file; extract the layer build information of each image layer in the target image from the configuration file.

[0176] In one embodiment, the target image is a business image in the business repository, which is built based on a base image or other images.

[0177] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0178] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0179] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0180] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for determining mirror dependency relationships, characterized in that, The method includes: Obtain the image metadata of the target image in the business repository; wherein, the image metadata includes the layer information of each image layer in the target image, and the layer information of each image layer includes the layer identifier and layer construction information of the image layer; Based on the layer information of each image layer in the target image, determine the layer hash value of each image layer in the target image; The dependency relationship between the target image and the base image is determined based on the layer hash value and layer construction information of each image layer in the target image, and the base hash value of the base image in the business repository.

2. The method according to claim 1, characterized in that, Based on the layer information of each image layer in the target image, determine the layer hash value of each image layer in the target image, including: For each image layer in the target image, the layer identifier and layer construction information of the image layer are spliced ​​together to obtain layer splicing information; A hash operation is performed on the layer splicing information to obtain the layer hash value of the mirror layer.

3. The method according to claim 1, characterized in that, The step of determining the dependency relationship between the target image and the base image based on the layer hash values ​​and layer construction information of each image layer in the target image, and the base hash value of the base image in the business repository, includes: For each image layer in the target image, the build time of the image layer is determined based on the layer build information of the image layer; Sort the image layers in the target image according to their construction time; Based on the sorting results, each image layer in the target image is combined to obtain at least two combined sets; The dependency relationship between the target image and the base image is determined based on the layer hash value of each image layer in each combination set and the base hash value of the base image in the business repository.

4. The method according to claim 3, characterized in that, The step of determining the dependency relationship between the target image and the base image based on the layer hash value of each image layer in each combination set and the base hash value of the base image in the business repository includes: For any set of combinations, determine the combined hash value of the set of combinations based on the layer hash value of the mirror layer in the set of combinations; The dependency relationship between the target image and the base image is determined based on the consistency between the combined hash value of each combination set and the base hash value.

5. The method according to claim 4, characterized in that, The base hash value includes the layer hash value corresponding to each image layer in the base image; The step of determining the dependency relationship between the target image and the base image based on the consistency between the combined hash value of each combined set and the base hash value includes: For any set of combinations, the group hash value of the set of combinations is compared with the layer hash value corresponding to each image layer in the base image for consistency. If any combination set has a combined hash value that matches the layer hash value corresponding to any image layer in the base image, then it is determined that there is a dependency relationship between the target image and the base image.

6. The method according to claim 1, characterized in that, The step of obtaining the image metadata of the target image in the business repository includes: Call the standard interface of the business repository to obtain the image manifest file and configuration file of the target image; Extract the layer identifier of each image layer in the target image from the image manifest file; Extract the layer construction information of each image layer in the target image from the configuration file.

7. The method according to any one of claims 1-6, characterized in that, The target image is a business image in the business repository, and the business image is built based on the base image or other images.

8. A device for determining mirror dependency, characterized in that, The device includes: The information acquisition module is used to acquire the image metadata of the target image in the business warehouse; wherein, the image metadata includes the layer information of each image layer in the target image, and the layer information of each image layer includes the layer identifier and layer construction information of the image layer; The hash determination module is used to determine the layer hash value of each image layer in the target image based on the layer information of each image layer in the target image; The dependency determination module is used to determine the dependency relationship between the target image and the base image based on the layer hash value and layer construction information of each image layer in the target image, and the base hash value of the base image in the business repository.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images