ConPan: A Tool to Analyze Packages in Software Containers
ConPan: A Tool to Analyze Packages in Software Containers
复制标题
ConPan：分析软件容器中的包的工具
DOI：
--
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
T. Mens
中科院分区：
文献类型：
--
作者：
Ahmed Zerouali;Valerio Cosentino;G. Robles;Jesus M. Gonzalez;T. Mens
将软件包和服务部署到容器中是一种流行的软件工程实践，可以提高可移植性和可重用性。Docker是最流行的容器化技术，可以帮助DevOps从业者进行日常活动。尽管被成功地并且越来越多地采用，但容器可能包括有缺陷的和易受攻击的包，这些包使容器已被部署在其中的环境处于危险之中。现有的质量和安全监控工具仅提供有限的支持来分析Docker容器，因此当分析超出安全目的时，从业人员必须执行额外的手动工作或开发临时脚本。这种限制也影响了希望以经验研究Docker容器及其包含的包的演变动态的研究人员。为了克服这一限制，我们提出了ConPan，一个自动化工具来检查Docker容器中的包的特性，例如它们的过时性和其他可能的缺陷（例如，漏洞和安全漏洞）。ConPan附带CLI和API，分析结果可以以多种格式呈现给用户。
Deploying software packages and services into containers is a popular software engineering practice that increases portability and reusability. Docker, the most popular containerization technology, helps DevOps practitioners in their daily activities. Despite being successfully and increasingly employed, containers may include buggy and vulnerable packages that put at risk the environments in which the containers have been deployed. Existing quality and security monitoring tools provide only limited support to analyze Docker containers, thus forcing practitioners to perform additional manual work or develop adhoc scripts when the analysis goes beyond security purposes. This limitation also affects researchers desiring to empirically study the evolution dynamics of Docker containers and their contained packages. To overcome this limitation, we present ConPan, an automated tool to inspect the characteristics of packages in Docker containers, such as their outdatedness and other possible flaws (e.g., bugs and security vulnerabilities). ConPan comes with a CLI and API, and the analysis results can be presented to the user in a variety of formats.