The invention relates to the field of
software security, and particularly discloses a
software patch security execution method and
system based on container isolation. The method comprises the following steps of: receiving a target
software path and a patch file path through a Go language; creating a temporary container environment, mounting a software
directory in a read-only mode, and mounting a patch file in an
executable mode; running a
network monitoring module in a
host machine, intercepting all network requests of the patch program in the container by adopting a transparent agent, and prompting a user to make a decision in real time; executing the predefined function
test script in the container, and verifying the integrity of the
core function through weighted calculation; and if the function test is passed and no network request is blocked,
synchronizing the modified file in the container to a target
directory of the
host machine, otherwise, automatically destroying the container. According to the method, malicious codes are isolated through the container, network behaviors are dynamically monitored,
functional integrity is automatically verified, and the problems of security risks and environmental
pollution of patch application are effectively solved.