Container Engine Policy Validation Before Isolation Container Creation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face security risks when using Docker, such as attacks on client environments due to running suspicious containers, leading to privacy disclosure and file loss.
Innovation Solution
A data processing method and apparatus that involve acquiring creation dependency resource information for an isolation container, performing validity verification using a valid policy file, and creating the container only if the verification is valid, thereby preventing the execution of potentially malicious containers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If Docker containerization is used to enable flexible service deployment, then service scalability and deployment flexibility are improved, but security risks increase due to potential attacks from suspicious containers
Solution Approach 1:
The patent performs validity verification on container creation dependency resource information before the container is actually created. By checking the policy file in advance and validating resource information (images, volumes, networks, etc.) before container instantiation, the system prevents malicious containers from being deployed, thus resolving the security risk while maintaining deployment flexibility.
2Productivity
If containers are created without validation to maintain deployment speed, then productivity is improved, but security reliability deteriorates due to potential malicious container execution
Solution Approach 1:
The verification process is performed during the container creation phase, checking policy compliance before the container actually runs. This preliminary validation ensures that security checks are integrated into the deployment workflow itself, not as a separate bottleneck, thereby maintaining productivity while improving reliability.
Solution Approach 2:
The patent introduces a policy file as an intermediary that mediates between the container creation request and the actual container instantiation. The policy file contains pre-defined security rules and resource constraints that automatically validate container creation parameters, providing a systematic way to ensure security without manual intervention and maintaining deployment speed.
3Reliability
If validity verification is performed on all container creation requests, then security reliability is improved, but device complexity increases due to additional verification mechanisms
Solution Approach 1:
The verification system uses a policy file that is self-contained and contains all the rules needed for validation. The system automatically reads and applies these rules without requiring complex external verification services or manual security configurations. This self-service approach reduces the complexity of the verification mechanism while maintaining high security reliability.
Solution Approach 2:
The patent validates container creation by checking specific parameters (image names, volume mounts, network configurations, etc.) against the policy file rules. By focusing verification on key parameters rather than performing comprehensive system-wide checks, the complexity of the verification process is reduced while still achieving high security reliability.
Data Source
AI summary
A data processing method based on a container engine and a related device are provided. The data processing method includes: acquiring, in response to a creation request for an isolation container, creation dependency resource information of the isolation container; performing validity verification on the creation dependency resource information based on a valid policy file of a container engine corresponding to the isolation container, to obtain a validity verification result of the isolation container; and creating the isolation container when the validity verification result is a valid result.