TWI805514B - Traceability system and its method - Google Patents

Abstract

The traceability system includes: a first container image registration repository; and a server that accesses the first container image registration repository and communicates with a second container image registry; wherein the server is from The second container image registry receives a first container image, and the server performs a security check on the first container image to generate a security confirmation; wherein the server is based on the first container image file and the security confirmation data to generate a second container image, the server stores the second container image in the first container image registry; wherein the second container image includes the first A container image file and a first hidden code image file, the first hidden code image file includes a first character string data.

Description

Traceability system and its method

The present invention relates to a traceability system and method thereof, in particular to a method that can ensure that all container image files (or called container image files) stored and/or used in the system are container image files that have met information security requirements. Traceability system and its method.

With traditional container image technology, users can download the required container image from different container image registries, and modify or adjust the content of the container image as required. However, for an enterprise, if it cannot ensure that each container image file downloaded by its internal employees is a safe and reliable container image file, it may cause great damage to the information security of the enterprise. In view of this, there is a need for a traceability system and method for ensuring that all container image files stored and/or used in the system are container image files that have met information security requirements.

In order to solve the above problems, one idea of the present invention is to provide a traceability system and method that can ensure that all container images stored and/or used in the system are container images that meet information security requirements. .

Based on the idea disclosed above, the present invention provides a traceability system, including: a first container image registry repository; and a server, accessing the first container image registry repository and communicating with a second container image repository a registry repository; wherein the server receives a first container image from the second container image registry, the server performs a security check on the first container image to generate a security confirmation; wherein The server generates a second container image based on the first container image and the security confirmation data, and the server stores the second container image in the first container image registry; wherein the server The second container image file includes the first container image file and a first hidden code image file, and the first hidden code image file includes a first string data.

In a preferred embodiment of the present invention, the server converts the first container image file into a first container image source file; wherein the server makes the first container image source file include the first hidden code image file, and convert the first container image source code file together with the first hidden code image file into the second container image file.

In a preferred embodiment of the present invention, the first container image registry stores a path record data, the path record data indicates a specific path; wherein the server makes the first container image file based on the path record data A hidden image file is associated with the specific path in the first container image source code file.

In a preferred embodiment of the present invention, the server receives a verification command, and based on the verification command, the server converts the second container image file into a second container image source code file; wherein the server automatically The second container image source file obtains the first encrypted image file, and obtains the first string data from the first encrypted image file; wherein the server complies with a security based on the first string data character string data, and generate a first authentication success data.

In a preferred embodiment of the present invention, the first container image registry store stores a path log data indicating a specific path; wherein the server is based on the path log data, from the The specific path in the second container image source code file obtains the first hidden code image file.

In a preferred embodiment of the present invention, the first container image registry stores a path record data, and the path record data indicates a specific path; wherein the traceability system further includes: a computer device, accessing the The first container image file is registered with the repository and communicated with the server, and the computer device sends a third container image file to the server; wherein the server converts the third container image file into a third container image source code file, and the server determines whether to store the third container image in the first container image registry based on the source file of the third container image and the path record data.

In a preferred embodiment of the present invention, the server obtains a second encrypted image file from the specific path of the third container image source code file, and obtains from the second encrypted image file A second string data; wherein the server stores the third container image file in the first container image registry repository based on the second string data matching a security string data.

In a preferred embodiment of the present invention, the server decides not to store the third container image based on the fact that the specific path in the third container image source file does not have a second hidden image file Register the repository with the first container image.

In a preferred embodiment of the present invention, the server obtains a second encrypted image file from the specific path of the third container image source code file, and obtains from the second encrypted image file A second string data; wherein the server decides not to store the third container image file in the first container image registry repository because the second string data does not match a security string data.

According to the purpose of the present invention, a traceability system is further provided, comprising: a first container image file registration repository storing a path record data indicating a specific path; a server accessing the first container an image file registry; and a computer device accessing the first container image registry and communicatively connected to the server, the computer device sending a third container image to the server; wherein the server will The third container image is converted into a third container image source file, and the server determines whether to store the third container image file in the first container image based on the third container image source file and the path record data. Container image registry repository.

In a preferred embodiment of the present invention, the server obtains a second encrypted image file from the specific path of the third container image source code file, and obtains from the second encrypted image file A second string data; wherein the server stores the third container image file in the first container image registry repository based on the second string data matching a security string data.

In a preferred embodiment of the present invention, the server decides not to store the third container image based on the fact that the specific path in the third container image source file does not have a second hidden image file Register the repository with the first container image.

In a preferred embodiment of the present invention, the server obtains a second encrypted image file from the specific path of the third container image source code file, and obtains from the second encrypted image file A second string data; wherein the server decides not to store the third container image file in the first container image registry repository because the second string data does not match a security string data.

According to the purpose of the present invention, a traceability method is further provided, which is applied to a traceability system, the traceability system includes a first container image file registration repository and a server, and the server accesses the first container image file registration repository , and the server is connected to a second container image registry; the trace method includes the following steps: the server receives a first container image from the second container image registry; the server performing a security check on the first container image to generate a security confirmation; generating a second container image by the server based on the first container image and the security confirmation; and by the server The device stores the second container image file into the first container image file registration repository; wherein the second container image file includes the first container image file and a first hidden code image file, the first hidden code image file The image file contains a first string of data.

In a preferred embodiment of the present invention, the traceability method further includes the following steps: converting the first container image file into a first container image original code file by the server; making the first container image file by the server The original code file includes the first hidden code image file, and the server converts the first container image original code file together with the first hidden code image file into the second container image file.

In a preferred embodiment of the present invention, the first container image file registry stores a path record data, and the path record data indicates a specific path; wherein the source tracing method further includes the following steps: the server based on The path records data so that the first hidden image file is associated with the specific path in the first container image source code file.

In a preferred embodiment of the present invention, the traceability method further includes the following steps: the server receives a verification instruction, and the server converts the second container image file into a second container based on the verification instruction an image source file; the server obtains the first encrypted image file from the second container image original file, and obtains the first string data from the first encrypted image file; and the server The device generates first authentication success information based on the first string data conforming to a security string data.

In a preferred embodiment of the present invention, the first container image registry store stores a path log data indicating a specific path; wherein the server is based on the path log data, from the The specific path in the second container image source code file obtains the first hidden code image file.

In a preferred embodiment of the present invention, the traceability system includes a computer device, the computer device accesses the first container image registration repository, and the computer device is connected to the server in communication; wherein the first container image The file registration repository stores a path record data, and the path record data indicates a specific path; wherein the traceability method further includes the following steps: sending a third container image file to the server by the computer device; The third container image is converted into a third container image source file; and the server determines whether to store the third container image file in the first container image based on the third container image source file and the path record data A container image registry repository.

In a preferred embodiment of the present invention, the traceability method further includes the following steps: the server obtains a second hidden code image file from the specific path of the third container image original code file; The server obtains a second string data from the second encrypted image file; and based on the second string data matching a security string data, the server stores the third container image file in The first container image registry repository.

In a preferred embodiment of the present invention, the traceability method further includes the following steps: the server does not have a second hidden code image file based on the specific path in the third container image original code file, and It is determined not to store the third container image in the first container image registry.

In a preferred embodiment of the present invention, the traceability method further includes the following steps: the server obtains a second hidden code image file from the specific path of the third container image original code file; The server obtains a second string data from the second encrypted image file; and the server determines not to image the third container based on the second string data not matching a security string data files are stored in the first container image registry repository.

According to the purpose of the present invention, a traceability method is further provided, which is applied to a traceability system, and the traceability system includes a first container image file registration repository, a server and a computer device, and the server accesses the first container image A file registry repository, the computer device accesses the first container image registry repository, and the computer device is communicatively connected to the server; wherein the first container image registry repository stores a path record data, the path record data Indicating a specific path; the tracing method includes the following steps: sending a third container image file to the server from the computer device; converting the third container image file into a third container image source code file by the server; And the server determines whether to store the third container image in the first container image registry based on the third container image source code file and the path record data.

In a preferred embodiment of the present invention, the traceability method further includes the following steps: the server obtains a second hidden code image file from the specific path of the third container image original code file; The server obtains a second string data from the second encrypted image file; and based on the second string data matching a security string data, the server stores the third container image file in The first container image registry repository.

In a preferred embodiment of the present invention, the traceability method further includes the following steps: the server does not have a second hidden code image file based on the specific path in the third container image original code file, and It is determined not to store the third container image in the first container image registry.

In a preferred embodiment of the present invention, the traceability method further includes the following steps: the server obtains a second hidden code image file from the specific path of the third container image original code file; The server obtains a second string data from the second encrypted image file; and the server determines not to image the third container based on the second string data not matching a security string data files are stored in the first container image registry repository.

The foregoing and other aspects of the invention will become more apparent from the following detailed description of non-limiting specific examples and with reference to the accompanying drawings.

Please refer to the first figure, which illustrates a system architecture diagram of a specific embodiment of the traceability system according to the present invention. In the embodiment shown in the first figure, the traceability system 100 includes a first container image registry repository 110 (the container image registry repository may be called a registry) and a server 120 . The server 120 can access the first container image registry 110 , and the server 120 is communicatively connected to the second container image registry 910 . In a specific embodiment, the traceability system 100 further includes a computer device 130 , the computer device 130 can access the first container image file registration repository 110 , and the computer device 130 is connected to the server 120 in communication. In a specific embodiment, the traceability system 100 of the present invention includes one or more processors, and the traceability system 100 implements the first container image file registration repository 110 and/or the server in a cooperative manner of hardware and software 120 and/or computer device 130. For example, the server 120 can transmit, receive and process various data, files or instructions in a manner of cooperative operation of hardware and software, and the computer device 130 can transmit, receive and process various data, files or instructions in a manner of cooperative operation of hardware and software. , and the first container image registry repository 110 can transmit, receive and store various data, files or instructions in a cooperative manner of hardware and software. In different specific embodiments, the computer device 130 can be a server, a computer, a laptop, a mobile device, etc., but is not limited thereto. It should be understood that, according to requirements, the computer device 130 can also be the server 120 .

In the embodiment shown in the first figure, the server 120 may receive the first container image file (the container image file may be called image or container image file) from the second container image file registration repository 910, and the server 120 may 120 may perform a security check on the first container image file to generate security confirmation data associated with the first container image file. Preferably, the security confirmation data indicates that the first container image file complies with information security requirements. The server 120 can generate a second container image based on the first container image and the security confirmation data, and the server 120 can store the second container image in the first container image registry 110 . Wherein, the second container image file includes the first container image file and a first hidden code image file, and the first hidden code image file includes a first string data. Preferably, the first string data indicates that the second container image file complies with information security requirements. After completing the aforementioned process, the second container image file stored in the first container image file registration repository 110 can be downloaded and/or used by the user (for example, the user can use the computer device 130 to register the first container image file The repository 110 retrieves and uses the second container image, or for example, the user can retrieve and use the second container image through the server 120 and register the repository 110 with the first container image).

It should be understood that the traceability system 100 can use the source code scanning technology (or use other technologies that can be used to confirm compliance with information security) by its server 120 to perform security checks on the first container image file according to requirements. In a specific embodiment, when the server 120 performs the security check, if the server 120 can confirm that the first container image file is downloaded from an official website that complies with information security, or if the server 120 can confirm that the first container image If the download source of the file is a third-party website that complies with information security, and the third-party website provides a guaranteed official source code, the server 120 will correspondingly generate security confirmation data.

It should be understood that when the server 120 performs a security check on a specific container image file, if it is found that the specific container image file does not meet the requirements for information security, the server 120 will not generate security confirmation data for the specific container image file, and also The specific container image is not stored in the first container image registry 110 . In this way, it can be ensured that the container image files stored in the first container image file registration repository 110 can pass the security check and meet the requirements of information security. In a specific embodiment, when the server 120 performs a security check on a specific container image file, if it is found that the specific container image file does not meet the requirements of information security, the server 120 will generate warning data for the specific container image file , the server 120 determines not to store the specific container image in the first container image registry 110 based on the specific container image and the warning data. Wherein, the warning data is associated with the specific container image file, and the warning data indicates that the specific container image file does not meet the requirements of information security.

In a specific embodiment, after the server 120 performs a security check on the first container image to generate security confirmation data, the server 120 may convert the first container image into a first container image source file (container image The original code file can be called a docker file). Then, the server 120 can make the first container image original code file include the first hidden code image file, and the server 120 can convert the first container image original code file together with the first hidden code image file into a second container image file. In this way, the second container image file includes the first container image file and the first hidden code image file. Preferably, the first container image registry repository 110 stores a path record data indicating a specific path. The server 120 can record data based on the path, so that the first encrypted image file is associated with a specific path in the first container image source code file. Specifically, the server 120 may record data based on the path, so that the first hidden code image file is contained (or stored) in a specific path in the first container image source code file.

In a specific embodiment, the server 120 receives a verification instruction, and the server 120 can convert the second container image file into a second container image original code file based on the verification instruction. Then, the server 120 can obtain the first hidden code image file from the second container image original code file, and obtain the first string data from the first hidden code image file. The server 120 can then generate a first verification success data based on the first string data conforming to a security string data. Preferably, the server 120 may receive verification instructions at intervals of a specific time length (that is, the server 120 will verify whether each container image file in the first container image registration repository 110 is Can pass the security inspection and meet the requirements of information security). Preferably, the server 120 can receive the verification instruction at a specific point in time (that is, the server 120 will verify at a specific point in time whether each container image file in the first container image file registration repository 110 can pass the security security checks and meet the requirements of information security). Preferably, the first container image registry repository 110 stores a path record data indicating a specific path. The server 120 can obtain the first hidden code image file from a specific path in the second container image source code file based on the path record data. In a specific embodiment, the first string data conforms to a security string data, which means that the content of the string indicated (or recorded) by the first string data is equal to that indicated by the security string data (or recorded) string content. In a specific embodiment, the first string data conforms to a security string data, which means that the content of the string indicated (or recorded) in the first string data matches the content indicated by the security string data output (or recorded) string content. Preferably, the content of the security string data can be set according to requirements.

In a specific embodiment, the first container image registry repository 110 stores path record data, and the path record data indicates a specific path. The traceability system 100 further includes a computer device 130 , and the computer device 130 can transmit the third container image file to the server 120 . The server 120 can convert the third container image file into a third container image source code file, and the server 120 can determine whether to store the third container image file in the third container image file based on the third container image source code file and the path record data The first container image is registered with the repository 110 . Preferably, the server 120 can obtain the second hidden code image file from the specific path of the third container image original code file, and the server 120 can also obtain a second string data from the second hidden code image file . Wherein, if the second string data conforms to the security string data, the server 120 stores the third container image file in the first container image file registration repository 110 based on the second string data conforming to the security string data . However, if the second string data does not match the security string data, the server 120 decides not to store the third container image file in the first container image file registry based on the second string data not meeting the security string data Repository 110. Preferably, the server 120 may decide not to store the third container image in the first container image registry 110 based on the fact that the specific path in the source code file of the third container image does not have the second hidden image file. .

In this way, when the user tries to store the third container image in the first container image registry 110 through the computer device 130, the server 120 can determine whether the third container image contains the third container image. Two hidden code image files, and whether the second string data in the second hidden code image file conforms to the security string data, so as to determine whether the third container image file can be stored in the first container image file registration repository 110. In this way, it can be ensured that all the container images stored in the first container image registration repository 110 can pass the security check and meet the requirements of information security. Preferably, in the traceability system 100 , the user can only download and use the container image files stored in the first container image file registration repository 110 . If the user downloads the external container image elsewhere, the external container image cannot be stored in the first container image registration repository 110 . In this way, it can be ensured that the container image files used by the user in the traceability system 100 can pass the security check and meet the requirements of information security.

Please refer to the second figure, which illustrates a system architecture diagram of a specific embodiment of the traceability system according to the present invention. In the embodiment shown in the second figure, the traceability system 200 includes a first container image registry 210 (the container image registry may be called a registry), a server 220 and a computer device 230 . The server 220 can access the first container image registry repository 210 , the computer device 230 can access the first container image registry repository 210 , and the computer device 230 is connected to the server 220 in communication. In a specific embodiment, the traceability system 200 of the present invention includes one or more processors, and the traceability system 200 implements the first container image file registration repository 210 and/or the server in a cooperative manner of hardware and software 220 and/or computer device 230. For example, the server 220 can transmit, receive and process various data, files or instructions in a cooperative manner of hardware and software, and the computer device 230 can transmit, receive and process various data, files or instructions in a cooperative manner of hardware and software. , and the first container image registry repository 210 can transmit, receive and store various data, files or instructions in a cooperative manner of hardware and software. In different specific embodiments, the computer device 230 can be a server, a computer, a laptop, a mobile device, etc., but not limited thereto. It should be understood that, according to requirements, the computer device 230 can also be the server 220 .

In the embodiment shown in the second figure, the first container image registry repository 210 stores path record data, and the path record data indicates a specific path. The computer device 230 may transmit the third container image to the server 220, the server 220 may convert the third container image into a third container image source file, and the server 220 may base the third container image source file and path Record data to determine whether to store the third container image in the first container image registry 210 . Preferably, the server 220 can obtain the second hidden code image file from the specific path of the third container image original code file, and the server 220 can also obtain a second string data from the second hidden code image file . Wherein, if the second string data matches the security string data, the server 220 stores the third container image file in the first container image file registration repository 210 based on the second string data matching the security string data . However, if the second string data does not conform to the security string data, the server 220 decides not to store the third container image file in the first container image file registry based on the second string data not conforming to the security string data repository 210 . Preferably, the server 220 may decide not to store the third container image in the first container image registry 210 based on the fact that the specific path in the source code file of the third container image does not have the second hidden image file. .

In this way, when the user tries to store the third container image in the first container image registry 210 through the computer device 230, the server 220 can determine whether the third container image contains the third container image. Two hidden code image files, and whether the second string data in the second hidden code image file conforms to the security string data, so as to determine whether the third container image file can be stored in the first container image file registration repository 210. In this way, it can be ensured that all the container images stored in the first container image registration repository 210 can pass the security check and meet the requirements of information security. Preferably, in the traceability system 200 , the user can only download and use the container image files stored in the first container image file registration repository 210 . If the user downloads the external container image elsewhere, the external container image cannot be stored in the first container image registration repository 210 . In this way, it can be ensured that the container image files used by the user in the traceability system 200 can pass the security check and meet the requirements of information security.

Please refer to the third figure, which illustrates a flow chart of a specific embodiment of the traceability system according to the present invention. As in the embodiment shown in the third figure, the traceability method 300 can be applied to a traceability system, the traceability system includes a first container image file registration repository and a server, the server accesses the first container image file registration repository, and the server A second container image registry repository is communicatively connected. The traceability method 300 starts at step 310 , the server receives the first container image file from the second container image file registration repository. Next, step 320 is executed, and the server performs a security check on the first container image file to generate security confirmation data. Next, step 330 is executed, and the server generates a second container image file based on the first container image file and the security confirmation data. Next, step 340 is executed, and the server stores the second container image file into the first container image file registration repository. Wherein, the second container image file includes the first container image file and the first hidden code image file, and the first hidden code image file includes the first string data. In a specific embodiment, the traceability method 300 further includes the following steps to generate the second container image file: converting the first container image file into the original code file of the first container image file by the server; making the first container image file by the server The original code file includes the first hidden code image file, and the server converts the first container image original code file and the first hidden code image file into a second container image file.

In one embodiment, the first container image registry stores path record data, and the path record data indicates a specific path. The traceability method 300 further includes the following steps: the server records data based on the path, so that the first hidden image file is associated with a specific path in the first container image source file. In a specific embodiment, the traceability method 300 further includes the following steps: the server receives a verification instruction; the server converts the second container image file into a second container image original code file based on the verification instruction; the server automatically The second container image source file obtains the first encrypted image file, and obtains the first string data from the first encrypted image file; and the server matches the security string data based on the first string data, and Generate first verification success information. In one embodiment, the first container image registry stores path record data, and the path record data indicates a specific path. Wherein, the server obtains the first hidden code image file from a specific path in the second container image original code file based on the path record data.

In a specific embodiment, the traceability system includes a computer device, the computer device accesses the first container image file registration repository, and the computer device communicates with the server. The first container image registry stores path record data, and the path record data indicates a specific path. The traceability method 300 further includes the following steps: sending the third container image file to the server by the computer device; converting the third container image file into a third container image source file by the server; The code file and path record data are used to determine whether to store the third container image file in the first container image file registration repository.

In a specific embodiment, the traceability method 300 further includes the following steps: the server obtains the second hidden code image file from the specific path of the third container image original code file; the server obtains the second hidden code image file from the second hidden code image file The file obtains the second string data; and based on the second string data conforming to the security string data, the server stores the third container image file into the first container image file registration repository. In a specific embodiment, the traceability method 300 further includes the following steps: the server decides not to store the third container image file based on the fact that the specific path in the original code file of the third container image file does not have the second hidden code image file Register the repository with the first container image. In a specific embodiment, the traceability method 300 further includes the following steps: the server obtains the second hidden code image file from the specific path of the third container image original code file; the server obtains the second hidden code image file from the second hidden code image file The file obtains the second string data; and the server decides not to store the third container image file in the first container image registry repository based on the fact that the second string data does not conform to the security string data.

Please refer to the fourth figure, which illustrates a flow chart of a specific embodiment of the traceability system according to the present invention. As shown in the embodiment shown in the fourth figure, the traceability method 400 can be applied to a traceability system. The traceability system includes a first container image registration repository, a server, and a computer device. The server accesses the first container image registration repository, The computer device accesses the first container image file registration repository, and the computer device communicates with the server. Wherein, the first container image registration repository stores path record data, and the path record data indicates a specific path. The traceability method 400 starts at step 410, the computer device sends the third container image file to the server. Next, step 420 is executed, and the server converts the third container image file into a third container image original code file. Next, step 430 is executed, and the server determines whether to store the third container image in the first container image registry based on the source code file of the third container image and the path record data.

In a specific embodiment, the traceability method 400 further includes the following steps: the server obtains the second hidden code image file from the specific path of the third container image original code file; the server obtains the second hidden code image file from the second hidden code image file The file obtains the second string data; and based on the second string data conforming to the security string data, the server stores the third container image file into the first container image file registration repository. In a specific embodiment, the traceability method 400 further includes the following steps: the server decides not to store the third container image file based on the fact that the specific path in the original code file of the third container image file does not have the second hidden code image file Register the repository with the first container image. In a specific embodiment, the traceability method 400 further includes the following steps: the server obtains the second hidden code image file from the specific path of the third container image original code file; the server obtains the second hidden code image file from the second hidden code image file The file obtains the second string data; and the server decides not to store the third container image file in the first container image registry repository based on the fact that the second string data does not conform to the security string data.

So far, the traceability system and method of the present invention have been described by the above description and drawings. However, it should be understood that the various specific embodiments of the present invention are only used for illustration, and various changes can be made without departing from the scope and spirit of the patent application of the present invention, and all should be included in the patent scope of the present invention. Therefore, the specific embodiments described in this specification are not intended to limit the present invention, and the true scope and spirit of the present invention are disclosed in the following claims.

100: Traceability system 110:First container image registry repository 120: server 130:Computer device 200: Traceability system 210: First container image registry repository 220: server 230: Computer device 300: Traceability method 310~340: Steps 400: Traceability method 410~430: Steps 910: Second container image registration repository

The first figure is a system architecture diagram of a specific embodiment of the traceability system of the present invention.

The second figure is a system architecture diagram of a specific embodiment of the traceability system of the present invention.

The third figure is a flowchart of a specific embodiment of the source tracing method of the present invention.

The fourth figure is a flow chart of a specific embodiment of the traceability method of the present invention.

none

100: Traceability system

110:First container image registry repository

120: server

130:Computer device

910: Second container image registration repository

Claims (26)

A traceability system, including: a first container image registry repository; and a server accessing the first container image registry and communicating with a second container image registry; wherein the server receives a first container image from the second container image registry, the server performs a security check on the first container image to generate a security confirmation; wherein the server generates a second container image based on the first container image and the security confirmation data, and the server stores the second container image in the first container image registry; Wherein the second container image file includes the first container image file and a first hidden code image file, and the first hidden code image file includes a first string data. The traceability system according to claim 1, wherein the server converts the first container image file into a first container image original code file; Wherein the server makes the first container image original code file include the first encrypted image file, and converts the first container image original code file together with the first encrypted image file into the second container image files. As in the traceability system of claim 2, wherein the first container image file registry stores a path record data, and the path record data indicates a specific path; Wherein the server records data based on the path so that the first hidden code image file is associated with the specific path in the first container image source code file. The traceability system of claim 2, wherein the server receives a verification instruction, and the server converts the second container image file into a second container image source code file based on the verification instruction; Wherein the server obtains the first encrypted image file from the second container image source file, and obtains the first string data from the first encrypted image file; Wherein the server generates a first verification success data based on the first character string data conforming to a security character string data. As the traceability system of claim 4, wherein the first container image file registry stores a path record data, and the path record data indicates a specific path; Wherein the server obtains the first hidden code image file from the specific path in the second container image source code file based on the path record data. As the traceability system of claim 1, wherein the first container image file registry stores a path record data, and the path record data indicates a specific path; The traceability system further includes: a computer device, accessing the first container image registry repository and communicating with the server, the computer device sending a third container image to the server; Wherein the server converts the third container image file into a third container image source code file, and the server determines whether to use the third container image file based on the third container image source code file and the path record data Save to the first container image registry repository. The traceability system according to claim 6, wherein the server obtains a second hidden code image file from the specific path of the third container image original code file, and obtains a first hidden code image file from the second hidden code image file two string data; Wherein the server stores the third container image file in the first container image registry repository based on the second string data conforming to a security string data. The traceability system according to claim 6, wherein the server decides not to store the third container image file in the third container image file based on the fact that the specific path in the third container image source file does not have a second hidden code image file A first container image registry repository. The traceability system according to claim 6, wherein the server obtains a second hidden code image file from the specific path of the third container image original code file, and obtains a first hidden code image file from the second hidden code image file two string data; Wherein the server decides not to store the third container image file in the first container image registry repository based on the fact that the second string data does not match a security string data. A traceability system, including: a first container image registry repository storing a path log data indicating a specific path; a server accessing the first container image registry; and a computer device, accessing the first container image registry repository and communicating with the server, the computer device sending a third container image to the server; Wherein the server converts the third container image file into a third container image source code file, and the server determines whether to use the third container image file based on the third container image source code file and the path record data Save to the first container image registry repository. The traceability system according to claim 10, wherein the server obtains a second hidden code image file from the specific path of the third container image source code file, and obtains a first hidden code image file from the second hidden code image file two string data; Wherein the server stores the third container image file in the first container image registry repository based on the second string data conforming to a security string data. The traceability system according to claim 10, wherein the server decides not to store the third container image file in the third container image file based on the fact that the specific path in the third container image source file does not have a second hidden code image file A first container image registry repository. The traceability system according to claim 10, wherein the server obtains a second hidden code image file from the specific path of the third container image source code file, and obtains a first hidden code image file from the second hidden code image file two string data; Wherein the server decides not to store the third container image file in the first container image registry repository based on the fact that the second string data does not match a security string data. A traceability method, applied to a traceability system, the traceability system includes a first container image file registry repository and a server, the server accesses the first container image file registry repository, and the server communicates with a The second container image file registration repository; the traceability method includes the following steps: receiving, by the server, a first container image from the second container image registry; performing a security check on the first container image by the server to generate a security confirmation; generating a second container image by the server based on the first container image and the security confirmation data; and storing, by the server, the second container image in the first container image registry; Wherein the second container image file includes the first container image file and a first hidden code image file, and the first hidden code image file includes a first string data. For example, the traceability method of claim item 14 further includes the following steps: converting the first container image file into a first container image source file by the server; causing the first container image source file to include the first cryptographic image file by the server, and The server converts the first container image source code file together with the first hidden code image file into the second container image file. As the traceability method of claim 15, wherein the first container image registry stores a path record data, and the path record data indicates a specific path; Wherein the traceability method further includes the following steps: the server records data based on the path, so that the first hidden code image file is associated with the specific path in the first container image original code file. For example, the traceability method of claim item 15 further includes the following steps: receiving a verification instruction from the server, based on the verification instruction, the server converts the second container image file into a second container image source code file; Obtaining the first encrypted image file from the second container image source file by the server, and obtaining the first string data from the first encrypted image file; and The server generates first verification success data based on the first character string data conforming to a security character string data. As the traceability method of claim 17, wherein the first container image file registry stores a path record data, and the path record data indicates a specific path; Wherein the server obtains the first hidden code image file from the specific path in the second container image source code file based on the path record data. The traceability method of claim 14, wherein the traceability system includes a computer device, the computer device accesses the first container image file registration repository, and the computer device is connected to the server through communication; Wherein the first container image file registry stores a path record data, and the path record data indicates a specific path; Wherein the traceability method further includes the following steps: sending a third container image file from the computer device to the server; converting, by the server, the third container image into a third container image source file; and The server determines whether to store the third container image in the first container image registry based on the third container image source code file and the path record data. For example, the traceability method of claim item 19 further includes the following steps: obtaining a second hidden code image file from the specific path of the third container image source code file by the server; obtaining a second string data from the second encrypted image file by the server; and The server stores the third container image file in the first container image registry repository based on the second string data matching a security string data. The source tracing method of claim 19 further includes the following steps: the server determines not to use the third container based on the fact that the specific path in the original image file of the third container does not have a second hidden code image file The image is stored in the first container image registry. For example, the traceability method of claim item 19 further includes the following steps: obtaining a second hidden code image file from the specific path of the third container image source code file by the server; obtaining a second string data from the second encrypted image file by the server; and The server determines not to store the third container image in the first container image registry based on the fact that the second string data does not match a security string data. A traceability method, applied to a traceability system, the traceability system includes a first container image file registration repository, a server and a computer device, the server accesses the first container image file registration repository, the computer device accessing the first container image registration repository, and the computer device is connected to the server in communication; wherein the first container image registration repository stores a path record data, and the path record data indicates a specific path; the traceability The method includes the following steps: sending a third container image file from the computer device to the server; converting, by the server, the third container image into a third container image source file; and The server determines whether to store the third container image in the first container image registry based on the third container image source code file and the path record data. For example, the traceability method of claim item 23 further includes the following steps: obtaining a second hidden code image file from the specific path of the third container image source code file by the server; obtaining a second string data from the second encrypted image file by the server; and The server stores the third container image file in the first container image registry repository based on the second string data matching a security string data. The source tracing method of claim 23 further includes the following steps: the server determines not to use the third container based on the fact that the specific path in the original image file of the third container does not have a second hidden code image file The image is stored in the first container image registry. For example, the traceability method of claim item 23 further includes the following steps: obtaining a second hidden code image file from the specific path of the third container image source code file by the server; obtaining a second string data from the second encrypted image file by the server; and The server determines not to store the third container image in the first container image registry based on the fact that the second string data does not match a security string data.

Images