KR102276885B1 - Apparatus and method for diagnosing docker image vulnerability - Google Patents

Abstract

The present invention relates to an apparatus for diagnosing Docker image vulnerabilities in a Docker system-based client and remote storage, and includes a vulnerability detection module and a vulnerability diagnosis module. When uploading/downloading a Docker image to/from the remote repository and the client, the vulnerability of the package existing in the Docker image is detected and output through the Docker image vulnerability detection module, and this is delivered to the vulnerability diagnosis module. The vulnerability diagnosis module receiving the image vulnerability detection result parses and counts the severity from the image vulnerability detection result, and calculates the image vulnerability score according to the defined score for each severity. If it exceeds the calculated image vulnerability score and image vulnerability threshold score, it establishes a secure Docker system between the client and remote storage by disallowing upload/download of images.

Description

DOCKER IMAGE VULNERABILITY DIAGNOSTIC APPARATUS AND METHOD FOR DIAGNOSING DOCKER IMAGE VULNERABILITY

The present invention relates to a security diagnosis apparatus for a Docker system, and more particularly, to an apparatus and method for diagnosing vulnerabilities through a vulnerability inspection on a Docker image.

Docker is one of the most widely used container-based technologies to deploy applications (eg, Apache, MySQL) in the form of images. Each Docker image contains the target application software, support libraries, and configuration files, and Docker containers are popular because they provide an equivalent runtime environment and an easy way to package and deploy multiple application instances.

A community centered on the creation and sharing of Docker images is emerging, and Docker Hub, introduced in 2014, is a representative cloud registry server for sharing application images. Since images are distributed using a repository, versioned image development and maintenance is possible. Repositories can also branch from other repositories.

Although the Docker Hub, which is a representative Docker repository, optionally performs image signing/verification, it cannot prevent malicious image distribution by malicious users. When a user downloads a malicious Docker image to the local Docker image repository and runs it as a container, accidents such as personal information leakage may be caused.

Vulnerabilities in Docker images that take advantage of the easy distribution and downloadability of Docker images continue to be known. Recently, a case of distributing cryptocurrency mining programs using Docker images has been confirmed. In the case of this attack, it has been shown that any attack is possible if Docker is being used, regardless of the OS of the target. Since this problem originates from the point that the user does not separately verify the security of the downloaded image, the need for diagnosing the vulnerability of the Docker image is emerging.

An object of the present invention is to provide a method for diagnosing vulnerabilities in a Docker image downloaded through a storage by a client.

A Docker image vulnerability diagnosis apparatus according to an aspect of the present invention includes a vulnerability detection module and a vulnerability diagnosis module.

Vulnerability detection module collects and stores vulnerability metadata from CVE (Common Vulnerabilities and Exposures) vulnerability databases at set intervals, and uses the image metadata collected from Docker images to analyze vulnerabilities and stored vulnerability metadata to generate vulnerability detection data. generated and output, the vulnerability diagnosis module parses the vulnerability detection data to obtain severity information, and calculates the vulnerability score of the Docker image using the severity information.

According to another aspect of the present invention, the vulnerability detection module may classify vulnerabilities included in the vulnerability whitelist input by the user as approved vulnerabilities, generate and output vulnerability detection data. In this case, the vulnerability diagnosis module may calculate the vulnerability score of the Docker image excluding the approved vulnerabilities.

In addition, if the Docker image is an image downloaded from a remote repository, the vulnerability diagnosis module of the various aspects of the Docker image vulnerability diagnosis device compares the calculated vulnerability score with the vulnerability threshold score to determine storage or disposal of the Docker image. have.

In addition, when the Docker image is an image built and loaded by the user, the vulnerability diagnosis module of the various aspects of the Docker image vulnerability diagnosis device compares the calculated vulnerability score with the vulnerability threshold score to upload or discard the Docker image to a remote storage. can be decided

According to an embodiment of the present invention, a Docker image vulnerability diagnosis method at least partially implemented as a program command executed in a Docker image vulnerability diagnosis apparatus includes the steps of: collecting and storing vulnerability metadata from CVE vulnerability databases at a set cycle; The steps of generating and outputting vulnerability detection data using the image metadata collected from the Docker image to be analyzed and the stored vulnerability metadata, parsing the vulnerability detection data to obtain severity information, and using the severity information in Docker and calculating a vulnerability score of the image.

According to another embodiment, in the vulnerability detection data generated and output in the step of generating and outputting the vulnerability detection data, the vulnerabilities included in the vulnerability whitelist input by the user are classified as approved vulnerabilities, and the vulnerability score is calculated. The step can calculate the vulnerability score of the Docker image excluding the approved vulnerabilities.

According to another embodiment, the Docker image vulnerability diagnosis method may further include determining storage or disposal of the Docker image by comparing the calculated vulnerability score with a vulnerability threshold score, wherein the Docker image is stored in a remote repository. It may be an image downloaded from , or an image built and loaded by the user.

According to the present invention, it is possible to achieve the effect of establishing a reliable environment for image upload/download between the client and the storage by managing the malicious Docker image based on the Docker image vulnerability diagnosis.

1 is a conceptual diagram illustrating a process of uploading/downloading and modifying a Docker image in a Docker system.
2 is a block diagram illustrating a configuration of an apparatus for diagnosing Docker image vulnerabilities according to an aspect.
3 illustrates an exemplary procedure for a client to upload an image to a repository using the Docker image vulnerability diagnosis device.
4 illustrates an exemplary procedure for a client to download an image from a repository using the Docker image vulnerability diagnosis device.
5 is an example of a code for parsing vulnerability detection data by the vulnerability diagnosis module.
6 is an example of a code in which the vulnerability diagnosis module calculates a vulnerability score using severity information.
7 is an example script for executing a Docker image vulnerability diagnosis method.

The foregoing and additional aspects are embodied through the embodiments described with reference to the accompanying drawings. It is understood that various combinations of elements in each embodiment are possible within the embodiments as long as there is no contradiction between them or other mentions. Each block in the block diagram may in some cases represent a physical component, but in other cases may be a part of the function of one physical component or a logical representation of a function across a plurality of physical components. Sometimes a block or part of an entity may be a set of program instructions. All or a part of these blocks may be implemented by hardware, software, or a combination thereof.

Docker is an open source project based on Linux containers, and with the advent of Docker, research on containers has been expanded. Unlike existing virtual machines, containers operate based on isolated control groups (cgroups) and namespaces assigned by the host operating system.

Namespaces are a feature of the Linux kernel that provides an isolated space for users such as file system, process, network, IPC, and hostname, and control groups (cgroups) are Linux system resources (e.g., memory, CPU, I/ It is a feature of the Linux kernel that provides control over resources (O, network, etc.)

Docker includes files and settings necessary for container execution in the form of images. In the case of Docker images, anyone using the Docker system can upload/download them.

1 is a conceptual diagram illustrating a process of uploading/downloading and modifying a Docker image in a Docker system. Docker creates a container environment based on images. The image is uploaded to the remote storage 30 and shared. The remote storage 30 can be configured as public or private. If you do not specify a repository, it is designated as a Docker hub by default, and uploading is possible by setting the repository as a private repository through parameter settings.

As shown in the process of uploading/downloading and modifying a Docker image shown in FIG. 1, the client may upload/download an image through the Docker engine when performing a command to upload/download a specific image.

However, as can be seen in FIG. 1, when the client downloads a Docker image from the remote storage 30 to the local environment or uploads a locally built Docker image to the remote storage, a separate authentication process for securing the Docker image is not performed. does not

2 is a block diagram illustrating a configuration of an apparatus for diagnosing Docker image vulnerabilities according to an aspect. The Docker image vulnerability diagnosis apparatus 10 according to an aspect of the present invention includes a vulnerability detection module 100 and a vulnerability diagnosis module 110 to detect vulnerabilities in a Docker image and diagnose vulnerabilities in the Docker image.

The vulnerability detection module 100 may be implemented as a program command executed in a computing device such as a personal computer, a server, etc., and collects and stores vulnerability metadata from the Common Vulnerabilities and Exposures (CVE) vulnerability databases 20 at a set period, and , using the image metadata collected from the Docker image to analyze vulnerabilities and the stored vulnerability metadata, generates and outputs vulnerability detection data.

The vulnerability detection module 100 collects vulnerability metadata necessary for vulnerability analysis from the Docker image from the external vulnerability database 20 in order to analyze the security vulnerability of each Docker image, and stores it in the database 115 within the module. As the vulnerability database 20, databases such as a CVE vulnerability database, Ubuntu CVE Tracker, Debian Security Bug Tracker, and Red Hat Security Data exist, and vulnerability information on Docker images is periodically collected from these databases. As an example, the vulnerability detection module 100 may use a CoreOS Clair open source tool or a tool developed by modifying it, and in this case, the vulnerability detection module 100 may use the vulnerability database 20 through the Vulnerability Updater. It periodically collects vulnerability metadata from the database 115 and stores it in the database 115 used by the vulnerability detection module 100 . As an example of CoreOS Clair, open source tools such as Anchor, Apparmor, and Dagda or tools developed by modifying them can be used, and commercial tools can also be used.

The vulnerability metadata that the vulnerability detection module 100 collects from the vulnerability database 20 such as the CVE vulnerability database, Ubuntu CVE Tracker, Debian Security Bug Tracker, and Red Hat Security Data for package vulnerability analysis by image is <Table 2> Includes items listed in

The image metadata that the vulnerability detection module 100 collects from the image to analyze the security vulnerability of each image includes the items listed in <Table 1>.

The vulnerability detection module 100 performs a vulnerability detection process for a Docker image when metadata including items listed in <Table 1> and <Table 2> is collected. Since the vulnerability detection process is known as an open source, a detailed description will be omitted.

The vulnerability detection module 100 detects vulnerabilities including the layer ID of the image analyzed through the vulnerability detection process, the total number of vulnerabilities in the image, the number of unauthorized vulnerabilities, CVE severity, package name, package version, and CVE information description output data.

The vulnerability detection module 100 may classify vulnerabilities included in a vulnerability whitelist input from a user as approved vulnerabilities, generate and output vulnerability detection data.

data field Explanation Image ID 256-bit long ID for each unique image Image Name An identifier for each image that follows a specific naming policy. Last Update Time Accurate data and last update time for images Layer ID Unique ID of each layer and relationship between layers Commands Image build related commands

data field Explanation Timestamp Accurate analysis time by vulnerability detection tool (eg Clair) Vulnerability ID Unique CVE identifier to identify vulnerabilities Severity Ranking Severity of each vulnerability Description of CVE Description of each identified vulnerability Associated Packages The name and exact version of the package associated with each vulnerability. Layer ID Specific image layers where vulnerabilities exist

The vulnerability diagnosis module 110 parses the vulnerability detection data to obtain severity information, and calculates a vulnerability score of the Docker image using the severity information.

Also, the vulnerability diagnosis module 110 is a module that determines whether a Docker image can be uploaded or downloaded based on information output from the vulnerability detection module 100 .

The vulnerability diagnosis module 110 calculates a vulnerability score based on the severity of the package vulnerability included in the Docker image among the information output from the image vulnerability detection module 100, and when the calculated vulnerability score is equal to or greater than the vulnerability threshold score, the corresponding Docker Images cannot be uploaded/downloaded, and the Docker image can only be uploaded/downloaded when the vulnerability is below the threshold score. In this case, the vulnerability threshold score can be set by the user.

sv means the Docker image package vulnerability severity, r _sv means the number of vulnerabilities of the corresponding severity, w _sv means the weight of the severity, and α means whether or not to be approved by the whitelist.

와 같이 도커 이미지 취약점 점수가 취약점 임계 점수(θ)를 초과하는 경우, 해당 이미지를 업로드 또는 다운로드할 수 없다. 즉, 다운로드한 이미지의 경우 설치하지 않고 폐기하고, 업로드되어야 할 이미지의 경우 업로드 하지 않고 폐기한다.The Docker image vulnerability score calculation by the vulnerability diagnosis module 110 is calculated according to <Equation 1>, and when a specific vulnerability of the corresponding package is included in the whitelist set by the user, the value α indicating whether the vulnerability is approved is becomes 0. In addition, in the case of vulnerabilities of packages that exist in images that are not set in the whitelist, α is 1. The vulnerability diagnosis module 110 calculates a Docker image vulnerability score according to Equation 1 and compares the vulnerability threshold score with the corresponding value. Comparison result of Docker image vulnerability score and vulnerability threshold score

When the Docker image vulnerability score exceeds the vulnerability threshold score ( θ ), the image cannot be uploaded or downloaded. That is, in the case of a downloaded image, it is discarded without installation, and in the case of an image to be uploaded, it is discarded without uploading it.

According to an embodiment of the present invention, the Docker image vulnerability diagnosis method, which is at least partially implemented as a program command executed in the Docker image vulnerability diagnosis apparatus 10, collects vulnerability metadata from the CVE vulnerability databases 20 at a set cycle, The steps of saving, generating and outputting vulnerability detection data using the image metadata collected from the Docker image to be analyzed for vulnerabilities and the stored vulnerability metadata, and parsing the vulnerability detection data to obtain severity information; and calculating a vulnerability score of the Docker image by using the severity information.

According to another embodiment, in the vulnerability detection data generated and output in the step of generating and outputting the vulnerability detection data, the vulnerabilities included in the vulnerability whitelist input by the user are classified as approved vulnerabilities, and the vulnerability score is calculated. The step can calculate the vulnerability score of the Docker image excluding the approved vulnerabilities.

According to another embodiment, the Docker image vulnerability diagnosis method may further include determining storage or disposal of the Docker image by comparing the calculated vulnerability score with the vulnerability threshold score, wherein the Docker image is stored in the remote storage 30, It may be an image downloaded from the repository) or an image built and loaded by the user.

가 취약점 임계 점수를 초과하는 경우, 해당 이미지를 삭제하는 명령을 수행하고 취약성 진단 모듈(110)은 도커 이미지 취약성 진단 결과를 클라이언트에게 송신하여 절차를 종료한다(미도시). 만약 계산된 취약점 점수

가 취약점 임계 점수 미만인 경우, 취약성 진단 모듈(110)은 클라이언트에게 도커 이미지 취약성 진단 결과를 송신하고(S1200), 안전한 이미지라는 결과를 수신한 클라이언트는 이미지 업로드 명령을 docker cli에 전달한다(S1220). docker cli는 해당 명령을 docker engine에 post 통신하며(S1240), 해당 명령을 수신한 docker engine은 원격 저장소(30)에 도커 이미지 업로드 요청을 수행한다(S1260). 요청을 수신한 원격 저장소(30)는 이미지 업로드가 완료되었다는 메시지를 클라이언트에게 송신한다.3 shows an exemplary procedure for a client to upload an image to a remote storage using the Docker image vulnerability diagnosis device. Referring to FIG. 3 , the vulnerability detection module 100 requests vulnerability metadata information from the vulnerability database 20 ( S1000 ). The received vulnerability database 20 transmits vulnerability metadata of Ubuntu, CentOS, etc. to the vulnerability detection module 100 (S1020), and the vulnerability detection module 100 stores the received vulnerability metadata in the vulnerability metadata DB. do (S1040). Procedures S1000 to S1040 are repeatedly performed according to a set period. The Docker image built by the client through the Docker engine for upload is loaded into the vulnerability detection module 100 for vulnerability diagnosis (S1060). The vulnerability detection module 100 extracts and collects image metadata listed in <Table 1> from the loaded Docker image (S1080). Based on the information extracted from the metadata in <Table 1> for the Docker image to be uploaded, the vulnerability detection module 100 extracts the vulnerability metadata related to the Docker image from the vulnerability metadata DB to generate and output vulnerability detection data (S1100). The vulnerability detection module 100 transmits the vulnerability detection data, which is the result of detecting the vulnerability of the Docker image, to the vulnerability diagnosis module 110 to determine whether the Docker image vulnerability score can be calculated and uploaded (S1120). The vulnerability diagnosis module 110 receiving the vulnerability detection data parses and counts severity-related information from the vulnerability detection data (S1140), reflects the score for each severity defined in <Table 3>, and according to <Equation 1>, The image vulnerability score is calculated (S1160) and compared with the vulnerability threshold score (S1180). If the calculated vulnerability score

exceeds the vulnerability threshold score, executes a command to delete the image, and the vulnerability diagnosis module 110 transmits the Docker image vulnerability diagnosis result to the client to end the procedure (not shown). If the calculated vulnerability score

is less than the vulnerability threshold score, the vulnerability diagnosis module 110 transmits a Docker image vulnerability diagnosis result to the client (S1200), and the client, receiving the result of a secure image, transmits an image upload command to the docker cli (S1220). The docker cli posts a corresponding command to the docker engine (S1240), and the docker engine that receives the command performs a docker image upload request to the remote storage 30 (S1260). The remote storage 30 receiving the request sends a message to the client indicating that the image upload is complete.

Notation definition Example Example Value sv Docker Image Vulnerability Severity unknown - negligible - low - medium - high - critical - r _sv number of sv r _unknown - r _negligible - r _low - r _medium - r _high - r _critical - w _sv weight of sv W _unknown 0.0 W _negligible 0.5 W _low 2 W _medium 5.45 W _high 7.95 W _critical 9.5 Img _score Total Severity Score for Docker Image Vulnerabilities - imiell/bad-dockerfile:178.65 parse(r _sv , result.txt) Parsing r _sv from result.txt - - α Docker Image Vulnerability Acceptable Value - approval value: 0
Unapproval value: 1 θ Docker Image Vulnerability Threshold Score - 150

가 취약점 임계 점수를 초과하는 경우, 해당 이미지를 삭제하는 명령을 수행하고(S2280) 취약성 진단 모듈(110)은 도커 이미지 취약성 진단 결과를 클라이언트에게 송신하여 절차를 종료한다(S2300). 4 illustrates an exemplary procedure for a client to download an image from a repository using the Docker image vulnerability diagnosis device. Referring to FIG. 4 , the vulnerability detection module 100 requests vulnerability metadata information from the vulnerability database 20 ( S2000 ). The received vulnerability database 20 transmits vulnerability metadata of Ubuntu, CentOS, etc. to the vulnerability detection module 100 (S2020), and the vulnerability detection module 100 transmits the received vulnerability metadata to the vulnerability metadata DB 115 ) is stored in (S2040). Procedures S2000 to S2040 are repeatedly performed according to a set period. The client transmits a docker image download command to the docker cli to download the docker image from the remote storage 30 (S2060). The docker cli sends the corresponding command to the docker engine through post communication (S2080), and the docker engine that receives the command requests the docker image to be downloaded from the remote storage (S2100). The remote storage 30 receiving the request downloads the requested image to the docker engine image storage of the client through download approval (S2120). The image downloaded from the remote storage 30 is loaded into the vulnerability detection module 100 from the docker engine image storage for vulnerability diagnosis (S2140). The vulnerability detection module 100 extracts and collects image metadata listed in <Table 1> from the loaded Docker image (S2160). Based on the information extracted from the metadata in <Table 1> for the downloaded Docker image, the vulnerability detection module 100 extracts the vulnerability metadata related to the Docker image from the vulnerability metadata DB 115 to generate vulnerability detection data. and output (S2180). The vulnerability detection module 100 transmits the vulnerability detection data, which is the result of detecting the vulnerability of the Docker image, to the vulnerability diagnosis module 110 to determine whether to calculate and discard the vulnerability score for the Docker image (S2200). The vulnerability diagnosis module 110 receiving the vulnerability detection data parses and counts severity-related information from the vulnerability detection data (S2220), reflects the score for each severity defined in <Table 3>, and according to <Equation 1>, The image vulnerability score is calculated (S2240) and compared with the vulnerability threshold score (S2260). If the calculated vulnerability score

exceeds the vulnerability threshold score, executes a command to delete the image (S2280), and the vulnerability diagnosis module 110 transmits the Docker image vulnerability diagnosis result to the client to end the procedure (S2300).

5 is an example of a code for parsing vulnerability detection data by the vulnerability diagnosis module. The example code shown in FIG. 5 is implemented in Python, but there is no limitation in the implementation language. Briefly describing the example code shown in FIG. 5 , the Open function is a function that opens an image vulnerability result value file obtained through the image vulnerability detection module 100 .

The Findall function is a function that parses severity content from vulnerability detection data, which is an image vulnerability result obtained through the vulnerability detection module 100 . Through this, the severity information (eg, unknown, negligible, low, medium, high, critical, defcon) existing in the Docker image vulnerability detection data is parsed.

The frequency.get function is a function that counts the number of severity levels parsed through the Findall function. Through this, the number of each severity is saved from the file in which image vulnerability detection data is stored.

The frequency function is a function that calculates the score for each severity based on the number of severity levels obtained from the file in which image vulnerability detection data is stored through the frequency.get function. This will calculate a score for each severity level.

6 is an example of a code in which the vulnerability diagnosis module calculates a vulnerability score using severity information. The example code shown in FIG. 5 is implemented in Python, but there is no limitation in the implementation language. Briefly describing the example code shown in FIG. 5 , the open function is a function that opens a file in which scores for each image vulnerability severity generated in FIG. 6 are stored.

The readlines function reads the file in which scores for each image vulnerability severity opened by the open function are stored line by line.

total += float(num) is a code that performs addition operation on scores by image vulnerability severity.

if total > θ compares the image vulnerability severity score obtained through total += float(num) with the image vulnerability threshold score ( θ ). If the threshold score is exceeded, "Delete your docker image" is output. , it prints "It's a Safe docker image".

print total outputs the image vulnerability severity score obtained through total+=float(num).

7 is an example script for executing a Docker image vulnerability diagnosis method. The main code of the script code shown in FIG. 7 will be briefly described.

docker-compose run -rm clair-scanner $1> dockerimage.txt performs vulnerability detection on the Docker image ($1) that the client wants to download using an open source tool (clair) that is an implementation example of the image vulnerability detection module 100 This command saves the vulnerability detection data, which is the result value, as dockerimage.txt.

sed '/Unapproved/!d' dockerimage.txt>result.txt is a command to parse only vulnerabilities not approved by the client for vulnerability detection data stored in dockerimage.txt and save it as result.txt.

while IFS= read -r line is the code to read the saved file line by line.

if ["$line" == "Delete your docker image"]; then docker rmi $1 is a file containing the string "Delete your docker image", which is output when the calculated vulnerability score exceeds the vulnerability threshold score, the image is executed through the docker rmi $1 (docker image to download) command. command to delete

7 is an example in which the vulnerability detection module of the Docker image vulnerability diagnosis device is implemented with Clair, and the implementation of the vulnerability diagnosis method does not have to be written as a script as in the example of FIG. Since this is only an example, the script may be configured with other procedures. In addition, implementation of the vulnerability detection module is not limited to Clair, and may be implemented using various vulnerability detection tools.

The Docker image vulnerability diagnosis method according to an embodiment diagnoses the vulnerability according to the score for each severity defined in <Table 3>, and the score for each severity defined in <Table 3> may be defined differently according to the user's criteria. Also, θ , which is the image vulnerability threshold score, may be defined differently according to the criteria of the client.

Although the present invention has been described above with reference to the accompanying drawings, the present invention is not limited thereto, and it should be construed to encompass various modifications that can be apparent from those skilled in the art. The claims are intended to cover such variations.

10: Docker Image Vulnerability Diagnostic Device
100: vulnerability detection module
110: vulnerability diagnosis module
115: Vulnerability Metadata Database
20: Vulnerability Database
30: Remote Storage

Claims (8)

Vulnerability metadata is collected and stored from CVE (Common Vulnerabilities and Exposures) vulnerability databases at a set interval, and vulnerabilities downloaded from a remote repository are analyzed using image metadata collected from Docker images and stored vulnerability metadata. a vulnerability detection module that generates and outputs vulnerability detection data; and
an image vulnerability diagnosis module for obtaining severity information from the vulnerability detection data, calculating a vulnerability score of the Docker image using the severity information, and determining storage or disposal of the Docker image by comparing the vulnerability score with a vulnerability threshold score;
A Docker image vulnerability diagnosis device comprising a. Vulnerability metadata is collected and stored from Common Vulnerabilities and Exposures (CVE) vulnerability databases at set intervals, and vulnerability using image metadata and stored vulnerability metadata collected from Docker images to analyze vulnerabilities built and loaded by users a vulnerability detection module that generates and outputs detection data; and
Image vulnerability for obtaining severity information from the vulnerability detection data, calculating a vulnerability score of the Docker image using the severity information, and comparing the vulnerability score with a vulnerability threshold score to determine upload or discard of a Docker image to a remote storage diagnostic module;
A Docker image vulnerability diagnosis device comprising a. The method according to claim 1 or 2,
The vulnerability detection module classifies vulnerabilities included in the vulnerability whitelist input from the user as approved vulnerabilities, generates and outputs the vulnerability detection data,
The vulnerability diagnosis module is a Docker image vulnerability diagnosis device for calculating the vulnerability score of the Docker image excluding the approved vulnerabilities. A Docker image vulnerability diagnosis method at least partially implemented as a program command executed in a Docker image vulnerability diagnosis device, the method comprising:
collecting and storing vulnerability metadata from CVE vulnerability databases at a set period;
generating and outputting vulnerability detection data using image metadata collected from a Docker image to analyze vulnerabilities downloaded from a remote repository and stored vulnerability metadata;
obtaining severity information from the vulnerability detection data;
calculating a vulnerability score of the Docker image using the severity information; and
determining storage or disposal of the Docker image by comparing the vulnerability score with a vulnerability threshold score;
A method for diagnosing Docker image vulnerabilities, including A Docker image vulnerability diagnosis method at least partially implemented as a program command executed in a Docker image vulnerability diagnosis device, the method comprising:
collecting and storing vulnerability metadata from CVE vulnerability databases at a set period;
generating and outputting vulnerability detection data using image metadata collected from a Docker image to be built and loaded by a user and analyzed for vulnerabilities and stored vulnerability metadata;
obtaining severity information from the vulnerability detection data;
calculating a vulnerability score of the Docker image using the severity information; and
comparing the vulnerability score with a vulnerability threshold score to determine upload or discard of a Docker image to a remote storage;
A method for diagnosing Docker image vulnerabilities, including 6. The method according to claim 4 or 5,
The vulnerability detection data generated and output in the step of generating and outputting the vulnerability detection data is generated by classifying vulnerabilities included in the vulnerability whitelist input by the user as approved vulnerabilities,
The calculating of the vulnerability score includes calculating the vulnerability score of the Docker image excluding the approved vulnerability. delete delete

Images