Abstract:

As a lightweight isolation method, the container has been widely applied due to its convenient deployment and portability. However, its isolation also naturally prevents its internal software components from being known by external detection tools. It will result in the inability to carry out general software component analysis and evaluation, further hindering threats in the software supply chain. To address this dilemma, this paper proposed a dependency-based vulnerability detection method in container supply chain, which was different from the popular tools that usually analyze by launching the target container. This method took the image as the granularity. The correlation between the layers in different images was used, this paper extracted the software formed based on the container image dependency on the basis of deconstructing the software image. The proposed method could detect supply chain security problems caused by multiple dimensions, such as image-content dependencies, execution-configuration dependencies, and dynamic build dependencies. The experimental results show that the proposed method can make sense in detecting various risks in the software supply chain and efficiently discover a large number of risks in public container repositories (such as Docker Hub).

Key words: software supply chain, container security, security detection, multi-dimensional dependency